Print Page - Malware Attack?

Title: Malware Attack?
Post by: The-Wishmaster on November 15, 2012, 04:27:08 PM

Hello again,

One of my members have rapported a problem.

When she go to the forum and look at a topic she get a pop up image with a link.

The images change but the link is the same..! I attached 1 of the images her (ScreenShot).

Is there a way for me to find out if 1# the site caught malware ? 2# her PC got infected ?

Thanking you in advance
Brian

Title: Re: Malware Attack?
Post by: emanuele on November 15, 2012, 04:30:20 PM

Can you post a link to your forum?

Title: Re: Malware Attack?
Post by: The-Wishmaster on November 15, 2012, 04:32:41 PM

I can send you a pm with the link the site if okay ?

The forum have adult content so no good idea to post it here i think ;)

Title: Re: Malware Attack?
Post by: emanuele on November 15, 2012, 04:42:20 PM

Okay.

Title: Re: Malware Attack?
Post by: The-Wishmaster on November 15, 2012, 04:49:07 PM

Pm send :) thanks

Title: Re: Malware Attack?
Post by: emanuele on November 15, 2012, 05:04:14 PM

Usually these things are added through javascript scripts, looking at the pages and at the files I can't see anything wrong on the site.
Of course I can see the forum only as guest, but it shouldn't be *that* different (since attackers usually put the scripts at the end of an "index.php" file or at the end of a .js file and I checked all the .js files).

I would suggest as quick (and non-conclusive) test your member to try with another browser and if possible with another computer.

Title: Re: Malware Attack?
Post by: The-Wishmaster on November 15, 2012, 05:16:47 PM

Thanks i do that, I did send you a user/pasword you can use if you need to login as a member ;)

I also did a Virus Scan from my CPanel and that came out okay ;D

Thanks again
Brian

Title: Re: Malware Attack?
Post by: emanuele on November 15, 2012, 05:22:14 PM

lol
I didn't see the user/pass...
/me is dumb sometimes...well...maybe not only "sometimes"... O:)

Title: Re: Malware Attack?
Post by: Storman™ on November 16, 2012, 04:51:58 AM

Not running Adsense are you by any chance ? There was an exploit earlier this week coming through some compromised Adsense ads. It's apparently sorted now but I'm seen several forums reporting popups and redirects in the past few weeks.

Might not be that but have you checked peoples sigs and avatars on affected pages or is it just random?

Title: Re: Malware Attack?
Post by: The-Wishmaster on November 16, 2012, 05:39:36 AM

No i don't use Adsense ;D

But the problem was the member had a BHO-hijacker on her browser, so the problem was not on the forum thanks God :P

Title: Re: Malware Attack?
Post by: DMR123 on November 16, 2012, 10:44:09 AM

It may not necessarily be from your forum..

What other web pages did your user have open? As you will know, you dont have to have one window open to prevent another from performing other actions

Title: Re: Malware Attack?
Post by: Kindred on November 16, 2012, 10:58:25 AM

ummm... DMR< the OP already stated that it was a user problem, not a forum problem.

Title: Re: Malware Attack?
Post by: DMR123 on November 16, 2012, 11:25:55 AM

Quote from: Kindred on November 16, 2012, 10:58:25 AM
ummm... DMR< the OP already stated that it was a user problem, not a forum problem.

QuoteWhen she go to the forum and look at a topic she get a pop up image with a link.

Therefore, that would make me think its a forum problem.

Title: Re: Malware Attack?
Post by: Kindred on November 16, 2012, 12:28:01 PM

Quote from: The-Wishmaster on November 16, 2012, 05:39:36 AM
But the problem was the member had a BHO-hijacker on her browser, so the problem was not on the forum thanks God :P

Title: Re: Malware Attack?
Post by: DMR123 on November 17, 2012, 08:50:33 AM

Okay.. I missed that bit. :)

Simple Machines Community Forum

SMF Support => SMF 2.0.x Support => Topic started by: The-Wishmaster on November 15, 2012, 04:27:08 PM