Website infected with Java exploit

[RoyalMess]

Hi there,

I run a SMF website but i have been approached by a local bank saying a customer of them has been infected and the infection came from the site running SMF.
The infection looks like this: https://www.dropbox.com/s/xyqf5hbz4ki8gla/image003.jpg
It only affects IE users with this Java exploit, how did it ever get into the site? All permissions are good and the recent version is installed since a few days.

The only anti virus that detects something is Nano Antivirus, i installed this in a VM and it found a HTML infection. This antivirus infected the file: smf\mobiquo\site.php

[RoyalMess]

As far as i found out now it appears the Tapatalk plug-in was exploited. Removed the plug-in and appears to be clean now.

[kat]

http://www.simplemachines.org/community/index.php?topic=379720.msg3575759#msg3575759

[RoyalMess]

http://www.simplemachines.org/community/index.php?topic=379720.msg3575759#msg3575759

Aii, missed that out. Been running Tapatalk for quite a while without issue's till now :|

[RoyalMess]

Cleaned up the malicious code that was put in place by someone exploiting Tapatalk and all clear now.

[kat]

Yay!