Page Index Toggle Pages: 1
Topic Tools
Hot Topic (More than 10 Replies) What is wrong with my forum ? (Read 5,447 times)
alakazam
YaBB Newcomer
*
Offline



Posts: 26
What is wrong with my forum ?
Apr 25th, 2013 at 10:32am
Post Tools
I haven't checked my forum for a week or so, being caught up with other projects, and when I visited it yesterday, I got a message saying that the site might be potentially harmful or contain malicious scripts or something like that:

http://popculturecommunity.com/YaBB.pl



What should I do ? Undecided
  
Back to top
YIM  
IP Logged
 
Bill Myers
God Member
Beta Testers
*****
Offline



Posts: 1,709
Location: Los Angeles

YaBB 2.4
Re: What is wrong with my forum ?
Reply #1 - Apr 25th, 2013 at 4:08pm
Post Tools
I'm guessing this could have happened because of malware that infected this forum not too long ago, and subsequently infected other YaBB forums when their Admin Centers were accessed. According to the admin of this forum, that malware has been removed. Unfortunately, as you've now noticed, it's still causing a problem on other YaBB forums.

You can read more about it at the following address here in this forum (there might be some answers for you there):

http://www.yabbforum.com/community/YaBB.pl?num=1359579478/

My apologies if the link above isn't working properly, but this forum's admin has been absentee for a while, so he hasn't been able to correct a 403 Forbidden Error that results when I use the IP address of my home office. As such, I'm using a proxy sever to access this forum.

Interestingly, when I access your forum with the proxy server, I don't get the "attack page" warning that I get when I access it normally. Go figure.

In any case, hopefully one of YaBB's staffers will know what to tell you to rid your forum of that malware. I'm sorry that your forum got infected.

By the way, that malware then spread to servers, and according to the records for your host, "Of the 2369 site(s) we tested on this network over the past 90 days, 49 site(s) ... served content that resulted in malicious software being downloaded and installed without user consent."

That could mean another site on the server you're sharing got infected with malware, which then spread to the server, and then to your forum. However, again, it's probably because of the malware from this site that caused the problem as it did for other YaBB forums.
  

Morning, noon, or night, have a great one!

Note: This forum doesn't allow for us to freely edit our posts or topics to make corrections as needed, so please remember to look for subsequent posts if you see any mistakes or outdated information. Sorry for the inconvenience.
Back to top
IP Logged
 
Bill Myers
God Member
Beta Testers
*****
Offline



Posts: 1,709
Location: Los Angeles

YaBB 2.4
Re: What is wrong with my forum ?
Reply #2 - Apr 25th, 2013 at 4:24pm
Post Tools
The thing to do is to contact your host, and let them know it seems the server you're hosted on has been infected with malware. They should be able to easily get rid of it for you (as well as get rid of it for those 49 other sites).

If you give the following information, that might help:

"This site was hosted on 1 network(s) including AS5577 (ROOT)."

Or they can just go to your site to see the warning themselves, at which point they can follow the link for more information.

Good luck!

  

Morning, noon, or night, have a great one!

Note: This forum doesn't allow for us to freely edit our posts or topics to make corrections as needed, so please remember to look for subsequent posts if you see any mistakes or outdated information. Sorry for the inconvenience.
Back to top
IP Logged
 
Dandello
YaBB Administrator
YaBB Next Team
Operations Team
Beta Testers
Support Team
*****
Offline



Posts: 2,434
Location: Earth

YaBB 2.6.1
Re: What is wrong with my forum ?
Reply #3 - Apr 25th, 2013 at 6:06pm
Post Tools
The malware problem here was solved well more than a week ago - if it had happened during the attacks on this (YaBBForum) site, you would have seen it a while back. BUT - check your yabbfiles directory (all the files in the subdirectories) and make sure none of them have recent change dates aside from the obvious ones - attachments and possibly user avatars.

Also check the files in the cgi-bin. The only files that should have recent dates on them will be in Boards, Messages, Members, and Variables. It there's anything in Admin, Sources, Modules, Templates, Languages, or Help that's newer than your install, there's a problem.

But let your host know there's a problem as it's an issue they need to be made aware of.
  

If you only have one solution to a problem you're not trying hard enough!
Back to top
WWW  
IP Logged
 
Derek Bullock
Ex Member


Re: What is wrong with my forum ?
Reply #4 - Apr 30th, 2013 at 10:29am
Post Tools
Bill Myers wrote on Apr 25th, 2013 at 4:08pm:
I'm guessing this could have happened because of malware that infected this forum not too long ago, and subsequently infected other YaBB forums when their Admin Centers were accessed.


Is that true????

We were all assured by JonB that the infection was confined to this YaBB Forum and that no other sites could be infected.
  
Back to top
 
IP Logged
 
Derek Barnstorm
Support Team
YaBB Next Team
Development Team
Beta Testers
****
Offline



Posts: 1,269
Location: United Kingdom

None
Re: What is wrong with my forum ?
Reply #5 - Apr 30th, 2013 at 1:49pm
Post Tools
I think it is very unlikely to be the case. The only risk to YaBB admin's when YaBBForum had a malware infection was their personal computer being infected, not their server. It sounds like a separate attack to me. I've seen users way before YaBB was attacked report here with the same issue. Unfortunately, it's very common.

And to clarify for anyone reading this post, this is not a problem with YaBB software, but a problem with where you are hosting it.
  
Back to top
 
IP Logged
 
Bill Myers
God Member
Beta Testers
*****
Offline



Posts: 1,709
Location: Los Angeles

YaBB 2.4
Re: What is wrong with my forum ?
Reply #6 - Apr 30th, 2013 at 10:14pm
Post Tools
Quote:

For the record, I was only guessing what could be the problem with his forum, and it's a surely inaccurate guess at that. My apologies!

I'm in agreement with the quotation of Derek Barnstorm above. Cool
  

Morning, noon, or night, have a great one!

Note: This forum doesn't allow for us to freely edit our posts or topics to make corrections as needed, so please remember to look for subsequent posts if you see any mistakes or outdated information. Sorry for the inconvenience.
Back to top
IP Logged
 
xnoddyx
Support Team
Documentation Team
YaBB Moderators
YaBB Next Team
Beta Testers
****
Offline



Posts: 1,591
Location: UK:Scotland/livingston

None
Re: What is wrong with my forum ?
Reply #7 - May 1st, 2013 at 7:34am
Post Tools
Hi alakazam

I can see the malware problem it is in your index.html Redirect file

in here it has
Code (HTML)
Select All
<p></p>

<iframe src="http://xxxxxxxxxxxxxxx.#$£/img2/count.htm" width="1" height="1" frameborder="0"></iframe></body>

</html>
<p>&nbsp;</p>

</body>
 


if you remove all of the code in the body tags
you will be good after the edit it will look like

Code (HTML)
Select All
<html>

<head>
<title>Forum Redirect</title>
<meta http-equiv="refresh" content="1; URL=http://popculturecommunity.com/YaBB.pl">
</head>


<body>
</body>

</html> 



Edited:
« Last Edit: May 1st, 2013 at 7:38am by xnoddyx »  

YaBB install help video
1. what yabb forum are you running and the url
2. describe in as much detail as you can what happens and also post screenshots if you can
3. please be patient we live in different time zones and have other commitments but we will help you
as bill and ted say (Be excellent to each other)
Back to top
IP Logged
 
alakazam
YaBB Newcomer
*
Offline



Posts: 26
Re: What is wrong with my forum ?
Reply #8 - May 9th, 2013 at 4:23pm
Post Tools
Bill Myers wrote on Apr 25th, 2013 at 4:24pm:
The thing to do is to contact your host, and let them know it seems the server you're hosted on has been infected with malware. They should be able to easily get rid of it for you (as well as get rid of it for those 49 other sites).

I did. They told me I should sort it out myself, cause they only deal with hosting, not scripts, coding etc.

Dandello wrote on Apr 25th, 2013 at 6:06pm:
Also check the files in the cgi-bin. The only files that should have recent dates on them will be in Boards, Messages, Members, and Variables. It there's anything in Admin, Sources, Modules, Templates, Languages, or Help that's newer than your install, there's a problem.

I did, and I can't find anything wrong in cgi-bin... Undecided

Derek Barnstorm wrote on Apr 30th, 2013 at 1:49pm:
And to clarify for anyone reading this post, this is not a problem with YaBB software, but a problem with where you are hosting it.

Not sure what you mean by "where". I am hosting with Edenhost.com

xnoddyx wrote on May 1st, 2013 at 7:34am:
Hi alakazam

I can see the malware problem it is in your index.html Redirect file

in here it has
Code (HTML)
Select All
<p></p>

<iframe src="http://xxxxxxxxxxxxxxx.#$£/img2/count.htm" width="1" height="1" frameborder="0"></iframe></body>

</html>
<p>&nbsp;</p>

</body>
 


if you remove all of the code in the body tags
you will be good after the edit it will look like

Code (HTML)
Select All
<html>

<head>
<title>Forum Redirect</title>
<meta http-equiv="refresh" content="1; URL=http://popculturecommunity.com/YaBB.pl">
</head>


<body>
</body>

</html> 



Edited:

Thanks. That seemed to be the problem, and I modified the index, but it doesn't seem to fix the problem. Can I PM you my account details to have a look for yourself ?
  
Back to top
YIM  
IP Logged
 
Dandello
YaBB Administrator
YaBB Next Team
Operations Team
Beta Testers
Support Team
*****
Offline



Posts: 2,434
Location: Earth

YaBB 2.6.1
Re: What is wrong with my forum ?
Reply #9 - May 9th, 2013 at 5:09pm
Post Tools
alakazam wrote on May 9th, 2013 at 4:23pm:
Not sure what you mean by "where". I am hosting with Edenhost.com

That's the 'where'.

And xnoddyx is the go-to person for things like this. (xnoddyx - make sure he gets the guestlanguage cookie fix.  Cool  but with other sites on the same host being infected, that's kind of a sign that the problem didn't originate with YaBB. )
  

If you only have one solution to a problem you're not trying hard enough!
Back to top
WWW  
IP Logged
 
xnoddyx
Support Team
Documentation Team
YaBB Moderators
YaBB Next Team
Beta Testers
****
Offline



Posts: 1,591
Location: UK:Scotland/livingston

None
Re: What is wrong with my forum ?
Reply #10 - May 9th, 2013 at 5:39pm
Post Tools
alakazam wrote on May 9th, 2013 at 4:23pm:
Thanks. That seemed to be the problem, and I modified the index, but it doesn't seem to fix the problem. Can I PM you my account details to have a look for yourself ?

I can pm or email me the admin login info for the forum and also ftp login info as well.

Dandello wrote on May 9th, 2013 at 5:09pm:
And xnoddyx is the go-to person for things like this. (xnoddyx - make sure he gets the guestlanguage cookie fix.    but with other sites on the same host being infected, that's kind of a sign that the problem didn't originate with YaBB. )

will do.
  

YaBB install help video
1. what yabb forum are you running and the url
2. describe in as much detail as you can what happens and also post screenshots if you can
3. please be patient we live in different time zones and have other commitments but we will help you
as bill and ted say (Be excellent to each other)
Back to top
IP Logged
 
xnoddyx
Support Team
Documentation Team
YaBB Moderators
YaBB Next Team
Beta Testers
****
Offline



Posts: 1,591
Location: UK:Scotland/livingston

None
Re: What is wrong with my forum ?
Reply #11 - May 11th, 2013 at 11:47pm
Post Tools
site is now clean note issued for advisement.
NOTE: your host server is still insecure ask you host if they can fix host permission as just now to r/w to files on the host server files and dirs. have to be set to chmod of 777

your host may even say chmod 777 is NOT a security risk but it is 777 gives all r/w/e to all set to 777.
  

YaBB install help video
1. what yabb forum are you running and the url
2. describe in as much detail as you can what happens and also post screenshots if you can
3. please be patient we live in different time zones and have other commitments but we will help you
as bill and ted say (Be excellent to each other)
Back to top
IP Logged
 
alakazam
YaBB Newcomer
*
Offline



Posts: 26
Re: What is wrong with my forum ?
Reply #12 - May 12th, 2013 at 11:33am
Post Tools
Awesome work, xnoddyx! Wink Thanks! I will contact my host and inform them about what you said. After Google re-evaluates it, I will try to focus more on making my forum more active, and attract more users.
  
Back to top
YIM  
IP Logged
 
xnoddyx
Support Team
Documentation Team
YaBB Moderators
YaBB Next Team
Beta Testers
****
Offline



Posts: 1,591
Location: UK:Scotland/livingston

None
Re: What is wrong with my forum ?
Reply #13 - May 12th, 2013 at 12:19pm
Post Tools
thank you and cool and also good luck with your forum.  Smiley
  

YaBB install help video
1. what yabb forum are you running and the url
2. describe in as much detail as you can what happens and also post screenshots if you can
3. please be patient we live in different time zones and have other commitments but we will help you
as bill and ted say (Be excellent to each other)
Back to top
IP Logged
 
Page Index Toggle Pages: 1
Topic Tools
 
  « Board Index ‹ Board  ^Top