Page Index Toggle Pages: 1
Topic Tools
Normal Topic Web attack Mass Injection Website 5 (Read 3,201 times)
Andrew Krakenberger
YaBB Newcomer
*
Offline



Posts: 3

YaBB 2.6.1
Web attack Mass Injection Website 5
Apr 9th, 2013 at 6:41pm
Post Tools
Please excuse me if this has already been discussed in this forum. If so please direct me to the thread this has been discussed in. I have two yabb forums in different domains.
When I and other people go to them, the antiviruses have started exhibiting warnings. My Norton basically says it has stopped a "Web Attack Mass Injection Website 5" whatever that is. In any case it is a nuisance I would like to get rid of. Any advise as to what I could do?
Many thanks
  
Back to top
 
IP Logged
 
Bill Myers
God Member
Beta Testers
*****
Offline



Posts: 1,723
Location: Los Angeles

YaBB 2.4
Re: Web attack Mass Injection Website 5
Reply #1 - Apr 9th, 2013 at 8:08pm
Post Tools
Andrew Krakenberger wrote on Apr 9th, 2013 at 6:41pm:
My Norton basically says it has stopped a "Web Attack Mass Injection Website 5" whatever that is.

A "Web Attack Mass Injection Website 5" is described as follows (source of quotation below):

Quote:
Description
This signature detects hidden iframe injected in websites, which upon visiting redirects the user to exploit kit hosted sites.

Unfortunately, this support forum was previously infected with malware that evidently then infected YaBB forums. If I'm remembering correctly, this malware infection presented itself in respective YaBB Admin Centers in the "What's new at YaBB?" section.

You can read more about this starting here in this topic.


  

Morning, noon, or night, have a great one!

Note: This forum doesn't allow for us to freely edit our posts or topics to make corrections as needed, so please remember to look for subsequent posts if you see any mistakes or outdated information. Sorry for the inconvenience.
Back to top
IP Logged
 
Andrew Krakenberger
YaBB Newcomer
*
Offline



Posts: 3

YaBB 2.6.1
Re: Web attack Mass Injection Website 5
Reply #2 - Apr 9th, 2013 at 8:56pm
Post Tools
Thank you very much Bill.
  
Back to top
 
IP Logged
 
xnoddyx
Support Team
Documentation Team
YaBB Moderators
YaBB Next Team
Beta Testers
****
Offline



Posts: 1,593
Location: UK:Scotland/livingston

None
Re: Web attack Mass Injection Website 5
Reply #3 - Apr 10th, 2013 at 12:05am
Post Tools
Hi Andrew Krakenberger

I have checked on several of my yabb forums and I am not getting any warnings,
as bill pointed out we did have a problem with this website getting hacked this is now fixed also this problem was only related to the admin Centers iframe What's new at YaBB?.

so I am thinking if you are getting this on your forums board index that it may be that your forum also maybe your website has been hacked it may even be your host that has been hacked so there may be more than just you on the server tha has been hacked can you email me your forums url and I will see what I can see for you I will then email you back and also post back here as well.
  

YaBB install help video
1. what yabb forum are you running and the url
2. describe in as much detail as you can what happens and also post screenshots if you can
3. please be patient we live in different time zones and have other commitments but we will help you
as bill and ted say (Be excellent to each other)
Back to top
IP Logged
 
Bill Myers
God Member
Beta Testers
*****
Offline



Posts: 1,723
Location: Los Angeles

YaBB 2.4
Re: Web attack Mass Injection Website 5
Reply #4 - Apr 10th, 2013 at 1:04am
Post Tools
Andrew Krakenberger wrote on Apr 9th, 2013 at 8:56pm:
Thank you very much Bill.

You're welcome even though I really wasn't able to actually help other than to point you in the right direction.

Just so you're aware if you don't already know, xnoddyx happens to be one of YaBB's resident experts, and he always seems to be able to fix any problem that any of us have with YaBB.

As he mentioned, maybe your website was hacked, which in turn may have added an iFrame into your forum. Then again, as he also more or less mentioned, one of the sites on the server you're on probably got infected with malware, and that probably infected other sites including yours.

Maybe you can have your host check for malware on the server so they can get rid of it, and then you should be fine.

Good luck!

  

Morning, noon, or night, have a great one!

Note: This forum doesn't allow for us to freely edit our posts or topics to make corrections as needed, so please remember to look for subsequent posts if you see any mistakes or outdated information. Sorry for the inconvenience.
Back to top
IP Logged
 
depablo
YaBB Moderators
YaBB Next Team
Beta Testers
***
Offline



Posts: 577
Location: UK

None
Re: Web attack Mass Injection Website 5
Reply #5 - Apr 10th, 2013 at 4:56am
Post Tools
Run your site through the online checker at
http://sitecheck.sucuri.net/scanner/

Also run all the tools available at
http://www.bleepingcomputer.com/
on your PC and ask the host to check their end. Wordpress had a social media plugin hacked which redirects to malware sites, good luck.

http://www.symantec.com/security_response/attacksignatures/detail.jsp?asid=25824
« Last Edit: Apr 10th, 2013 at 10:14am by depablo »  

Taking a peek behind the mask Wink
Back to top
 
IP Logged
 
Andrew Krakenberger
YaBB Newcomer
*
Offline



Posts: 3

YaBB 2.6.1
Re: Web attack Mass Injection Website 5
Reply #6 - Apr 12th, 2013 at 6:47am
Post Tools
Thank you for your help everybody! Problem mostly solved right now.
  
Back to top
 
IP Logged
 
xnoddyx
Support Team
Documentation Team
YaBB Moderators
YaBB Next Team
Beta Testers
****
Offline



Posts: 1,593
Location: UK:Scotland/livingston

None
Re: Web attack Mass Injection Website 5
Reply #7 - Apr 12th, 2013 at 3:43pm
Post Tools
Andrew Krakenberger wrote on Apr 12th, 2013 at 6:47am:
Thank you for your help everybody! Problem mostly solved right now.

cool that is good to know if you need any more help with this postback or if you have any more probs  Wink
  

YaBB install help video
1. what yabb forum are you running and the url
2. describe in as much detail as you can what happens and also post screenshots if you can
3. please be patient we live in different time zones and have other commitments but we will help you
as bill and ted say (Be excellent to each other)
Back to top
IP Logged
 
Page Index Toggle Pages: 1
Topic Tools