Forums Down! "Add-on Remote Data Services Data Control" error for users. Help?

[TK1994]

Everyone hitting our website today is getting the following pop up error:

"This website wants to run the following add-on: "Remote Data Services Data Control" from Microsoft Corporation"

It's similar to the error in this topic, which I found in a search.

http://www.simplemachines.org/community/index.php?topic=224858.0


The non-SMF pages on the same domain all work fine, but the index and forums are both SMF based and are both producing this error.  I tried calling my host, they say it's some sort of script exploit or something.

Can anyone help point me in the right direction for a fix?

[karlbenson]

Can you please post a link to your forum/page that is affected.
View the source code of the page, has anything been inserted?

If is the common sort if code injection into files that I believe it is, it is usually caused by a compromised host.

[TK1994]

The addresses are hxxp:www.garrisontitan.com [nonactive] and hxxp:www.garrisontitan.com/theboard [nonactive]

I've got redirects up right now, but you can reach the old addresses here:

hxxp:www.garrisontitan.com/error-index.php [nonactive]
hxxp:www.garrisontitan.com/theboard/error-index.php [nonactive]

I just checked the first one 20 seconds ago and it will load for about a minute before producing that error.

[unExpected]

Hello,

I received a Threat warning from AVG Web shield while accessing your site, see the attached image.

Regards
Mashahood

[Oldiesmann]

I'm just getting the standard "Connection problems" error when I visit the "theboard" one...

[TK1994]

I've been researching all evening. This may (may) be a problem with a security hole in a Coppermine image gallery on my site that wasn't udpated to the newest version.

Apparently, this hack is well known on the Coppermine boards, and it overwrites every HTML and PHP file on the server with the compromised code. Conceivably, this is how it spread to my SMF boards and main page...and now every page on my website redirects you to some address named:

DO NOT VISIT THIS URL!

Code Select Expand

hxxp://cdpuvbhfzz.com/dl/adv598.php[/color]
DO NOT VISIT THIS URL!

Here's a thread I found with more information:

hxxp:forum.coppermine-gallery.net/index.php/topic,51927.0.html [nonactive]

I'm currently working with my web host company to see what they can do, but I'm totally at a loss right now.  Only fix I can think of is blowing the whole site away and I don't have a very recent back up.....it's a tough situation.


Mashahood, can you tell me what kind of threat your virus program says this is?  Do they have a file or a patch for it yet?  I can't seem to find any info on virus research sites yet.

[karlbenson]

I put the link in code, so users can't accidentally click it.

[青山 素子]

I put the link in code, so users can't accidentally click it.

I did you one better and changed to hxxp. Gotta protect against copy paste monkeys.

[karlbenson]

I don't know. I wouldn't mind content scrapers following it
Bad boys deserved to be treated badly

[Bulakbol]

Here's more info.