Malware Alert on this Website

[Aeni]

@Pingu & Mods:

I think your website has been compromised. As soon as I visited this website, a prompt asked me if I wanted to install some kind of application for Microsoft Support but the signer was from Sadii.net (or was it Sadiis.net?) In any event, I hit cancel and Java fired up and I can see shit being installed in background from maxtravel.com, itour.com, etc. Not sure who your advertising agency is but it may be through them that this is happening if your website has not been compromised.

Could you guys investigate on your end and contact whoever your ad agency is (the one that you're hosting here and presumably getting paid for clicks/visits)

[Jarre]

Re: Malware Alert on this Website

I see nothing kasperksy labs hasn't picked up anything and nothing has been installed here. (though kasperksy does block things without telling me alot of the time)

[Firewind]

Re: Malware Alert on this Website

No Script is blocking the following:

maxtravel.com.ua
itour.com.ua
i.ua
gismeto.ru
yandex.ru

Yeah I'd say that it's malware as not one of those sites have appeared as running scripts on the site before today.

[PiNG]

Re: Malware Alert on this Website

thanks, looking into it now

[Icemage]

Re: Malware Alert on this Website

Well, seems the forums are back up - sort of. Templates are completely borked, YouTube embed plugin is also borked, but most of the critical functions seem to be working.

EDIT: No, I'm wrong. Not everything is working. This post double-posted itself from Quick Reply.


Icemage

[PiNG]

Re: Malware Alert on this Website

yeah, working on it, embed plugs ins just need rebuilding. I ended up just upgrading the entire forum, i'll keep working at it and get it back to normal. I kinda don't like how some things work on this new version, but i should able to fix it.

[Icemage]

Re: Malware Alert on this Website

Honestly, with the version upgrade to vBulletin 4 I'm surprised as much of the forum is intact as it is. I'll spent a little more time poking at the forum functions and see if there's anything else wrong, but most everything seems OK. User control panel works, signatures work, private messaging works, mod tools works.

EDIT: Posting from Advanced Reply does not exhibit the same double-posting behavior.


Icemage

[Omgwtfbbqkitten]

Re: Malware Alert on this Website

This prompt is also happening;

This page is asking you to confirm that you want to leave - data you have entered may not be saved.

Found it as I tried to back out from making a silly comment.

There was a sighting of a dragon flying in reverse on the Video Game forum, btw.

[Feba]

Re: Malware Alert on this Website

Honestly, PiNG, I really wonder why you bother sometimes.

I mean, your running this place is a damned act of charity.

[Jarre]

Re: Malware Alert on this Website

We all appreciate his efforts Feba and those of the other staff that help run this.

[Raydeus]

Re: Malware Alert on this Website

I'm liking the upgrade. PiNG kept all the good things and upgraded others that are working better now.

If only YouTube could learn a thing or two from him. orz


PS > So what was this about malware on the site anyway? Should I scan for something specific or does my comp not even bothering with it mean it was a weak bug. Because I'm not noticing anything weird either.

Honestly, PiNG, I really wonder why you bother sometimes.

I mean, your running this place is a damned act of charity.

Because he loves us, of course.

[Squiggs]

Re: Malware Alert on this Website

This seems as good a place as any to ask: How do you 'Quote Selected' now? I may be missing it, but I can't seem to find it.

[DakAttack]

Re: Malware Alert on this Website

There was a sighting of a dragon flying in reverse on the Video Game forum, btw.

...

[Squiggs]

Re: Malware Alert on this Website

Okay, so you can do it. When I hit the 'Reply With Quote' it quotes the whole thing, regardless of what I have highlighted.

[PiNG]

Re: Malware Alert on this Website

Thanks, it's not really much that I do, I really always appreciated the help I got from moderators and admins, as well as people continuing to use the site as a community point.

It's not really much that I do though, I had purchased all the forum software about a year ago, but had never got around to upgrading it. I was just being lazy. The dedicated server it's running on is also running other websites, which covers the server cost.

As far as the malware, it was a backdoor on one of my old script that caused someone to inject malware JavaScript to give other sites false hits. For example you still see FFXIOnline.com stuff, but small little images/gif/jpg (usually in 1px by 1px, a dot) at bottom of the site that is hosted by other websites to pretend they are getting hits too. I'll keep the site fully updated from now, and Taskmage has been very good in giving me heads up whenever something happened to the site. I really appreciate it!

Through the weekend, I'll clean up the site skin and get it back to how it was before. with Light and Dark themes, and perhaps now mobile themes aswell for some people to use