PC Gamer Mar 16 @ 8:25am
Steam Community Virus? False Positive or what?
While trying to sell a Dota 2 item on the Steam community market, my ant-virus (AVG) detected and blocked an 'Exploit neosploit exploit kit (type 87)'.

The Message said:

Threat: exploit neosploit exploit kit (type 87)

Object name: cdn.steamcommunity.com/public/javascript/jqplot/plugins/jqplot.cursor.js?v=1546577426&l=english

Note how it specifically mentions steam in the object name, and this happened simultaneously while listing an item on the market.

What's going on here? Can a Steam representative answer please, or investigate?

Thanks a lot.
Showing 1-15 of 15 comments
< >
PC Gamer Mar 16 @ 8:25am 
I am using the steam client, I did not click any dodgy links. I finished my game of Dota 2, then went to the market to sell an item, and this happened.
sfnhltb Mar 16 @ 8:40am 
Originally posted by Totalwargamer:
While trying to sell a Dota 2 item on the Steam community market, my ant-virus (AVG) detected and blocked an 'Exploit neosploit exploit kit (type 87)'.

The Message said:

Threat: exploit neosploit exploit kit (type 87)

Object name: cdn.steamcommunity.com/public/javascript/jqplot/plugins/jqplot.cursor.js?v=1546577426&l=english

Note how it specifically mentions steam in the object name, and this happened simultaneously while listing an item on the market.

What's going on here? Can a Steam representative answer please, or investigate?

Thanks a lot.

I can't tell you if it is a virus or a false positive, but the reason it would mention Steam would be because when you go to a website like Steam it has to download the pages to your computer to show them, including the client side logic - in this case it refers to the code that runs part of the jqplot control, which is a reasonably common web component for showing a graph, given that you were in the marketplace, presumably it is being used by the graph showing the prices over time of the item.

Given it was downloaded from the Steam servers directly it seems more likely AVG is giving a false positive than it really being a virus.
Satoru Mar 16 @ 9:33am 
You computer is likely compromised and doing a hosts or DNS redirect
Ericrct Mar 16 @ 2:16pm 
Purge the DNS cache
PC Gamer Mar 16 @ 8:08pm 
Originally posted by Satoru:
You computer is likely compromised and doing a hosts or DNS redirect

Strange, since I very recently completed scans and kept all of my anti-virus/malware tools up to date.

Anyway, I've flushed the DNS and will scan again I suppose..
Silicon Vampire Mar 16 @ 8:20pm 
Hasn't there also been a recent rash of routers being compromised? That wouldn't even show up on an individual computer but every device on the network would be affected...

I'll see if i can find what i'm remembering here... brb

--------------------

http://www.techradar.com/us/news/networking/routers-storage/more-than-300-000-office-and-home-routers-infected-in-new-mega-hack-1230805
Last edited by Silicon Vampire; Mar 16 @ 8:22pm
PC Gamer Mar 16 @ 8:26pm 
^ Funny, I just googled it and read the same article you linked haha.

I'm not sure if that's the issue but you never know. I've flushed the DNS now and I'm conducting another scan, AVG already blocked and removed the threat yesterday but I might as well double check.
H0licShot Mar 26 @ 12:43am 
Originally posted by Totalwargamer:
^ Funny, I just googled it and read the same article you linked haha.

I'm not sure if that's the issue but you never know. I've flushed the DNS now and I'm conducting another scan, AVG already blocked and removed the threat yesterday but I might as well double check.

I just had the same problem. I was browsing TF2 keys in the market, clicked on a profile that was selling several keys and AVG pops up with an alert for the same exploit. AVG had locked it down. On the advice of this discussion, I flushed my DNS. then I had AVG perform a scan and it turned up with nothing. I submitted a report to Steam Support.

Any new developments on this for you?
PC Gamer Mar 26 @ 12:48am 
They gave a standard reply saying anti-viruses can interfere with the way steam games operate (note that the word is 'steam games', when i wasn't actually playing a game...)

Nevertheless, in their technical area they suggest disabling your anti virus when playing on steam due to conflicts.

I won't be doing that though.
Last edited by PC Gamer; Mar 26 @ 2:15am
H0licShot Mar 26 @ 12:52am 
Neither will I. I was also not playing a game when it happened.

Thanks for making this thread and replying.
PC Gamer Mar 26 @ 12:56am 
It'll be interesting to see if they give you the same textbook reply as they gave me.
H0licShot Mar 26 @ 1:00am 
I'll let you know when they reply (could be days, weeks). I'll post it in this thread.

Steam's been going down every few days for a lot of people all over the world (including me, last night specifically) according to Twitter activity. I wonder if there's a correlation. Some secuirty issue that we're not being told about. Or maybe this is all crap.
H0licShot Mar 26 @ 4:36pm 
Originally posted by Totalwargamer:
It'll be interesting to see if they give you the same textbook reply as they gave me.

They did indeed give me the same textbook reply. Setting anti-virus to allow Steam and its games etc. Included was "Steam and its games do not contain malware." Which I think is a bit of an arrogant thing to say these days.

Anyway, that's all I have. I'll post here again if a similar problem should arise. I hope OP and everyone stays clean.
PC Gamer Mar 26 @ 4:40pm 
Lol, it's a shame they don't take it more seriously.

I don't think they are infected, but it still seems to a legitimate possibility to me, especially since it's not solely my issue.
2point4 Mar 26 @ 7:03pm 
Originally posted by Muppet among Puppets:
So, you think they need users to run an antivirus to determine if they store/deliver a virus?
It looks like at some point in the near future that's exactly what they'll be needing from their users.

http://www.pcgamer.com/2014/03/13/steam-will-allow-you-to-report-a-product-for-malware-pornography-other-reasons/

At the point that this "feature" goes live they will be saying exactly, "Steam and our games might include malware".
Showing 1-15 of 15 comments
< >
Per page: 15 30 50
Date Posted: Mar 16 @ 8:25am
Posts: 15