Forum redirected to a spam site...help!

[ransclan.com]

It doesn't happen all the time, but it has happened to me several times and I'm getting a lot of complaints about it from users.

When someone clicks on my forum, instead of opening the forum, a different site pops up that wants to run a "virus detection" bug.

I've had my server scan my entire account and they can't find anything. It only happens when someone tries to open the forum (www.ransclan.com/forums) and again it does not do it every time.

Please tell me what's going on and how I can fix this!

Thank you!!

[dodgeboard.com]

Your site appears to be clean.

I would suspect your browser has been hijacked by some malware.

Try downloading malwarebytes.org and scanning for malware on your PC. Have any users that are experiencing the same issues do the same.

These fake antivirus threats are becoming very prevalent.

[ransclan.com]

NO my site is not clean. I have 255 people on the forum and the ONLY time they get this re-direct is when they visit my vBulletin forum!!

I would appreciate it if vB tech support would chime in here and help me solve this problem.

There is a virus in my vBulletin software and I need to know how to get rid of it.

Thank you.

[dodgeboard.com]

There are probably 10,000+ sites running vBulletin. It's not the software.

vBulletin Tech Support cannot help you with a virus on your host. That would be like having an auto accident and expecting your dealer warranty to cover it. You need to contact your host and work this out with them. I am trying to lead you in the right direction.

NOTE: I checked your site with a very basic site scanner. It wont detect everything, but I was trying to help you nontheless.

FWIW, I perused about 20 threads on your site and never had a problem.

Good luck!

[Dilly]

You need to be more specific. Either post a screenshot when it does happen, or a link to a thread that it does occur on.

[Suiram]

NOTE: I checked your site with a very basic site scanner. It wont detect everything, but I was trying to help you nontheless.

tell me more about this scanner that can check a website ? link ? ta.

[dodgeboard.com]

http://www.unmaskparasites.com/

Very basic.

There are several others out there.

[ransclan.com]

This is the first thing that pops up....



Then the browser goes to another site (I will get a screen shot of that the next time I get it) that looks like it's running a scan of my computer.

I know the above picture probably doesn't tell you too much but that's the first thing that pops up. It doesn't happen all the time and that's what's frustrating!!

My server has scanned my entire account and can not find any viruses. It seems this one is pretty well hidden.

[Steve Machol]

It could be a false positive.

To troubleshoot this, first reupload all the original vB non-image files (except install.php). Make sure you upload these in ASCII format and overwrite the ones on the server. Also be sure to upload the admincp files to whichever directory you have set in your config.php file. Then run 'Suspect File Versions' in Diagnostics to make sure you have all the original files for your version and that none show 'File does not contain expected contents':

Admin CP -> Maintenance -> Diagnostics -> Suspect File Versions

[Note: In some cases you may also need to remove any of the listed .xml files in the includes/xml directory.]

Next, disable all plugins.

Note: To temporarily disable the plugin system, edit config.php and add this line right under <?php

define('DISABLE_HOOKS', true);

Then if you still have this problem, create a new style and choose no parent style. This will force it to use the default templates. Finally empty your browser cache, close all browser windows then try again. Make sure you change to the new style and view your forums with it.

Do you have the same problem?

[ransclan.com]

Thanks Steve, I just upgraded from 3.8.2 to 3.8.4 and used the overwrite method. I just ran the Suspect File Versions and everything is okay except the following ajax.php file...




I'm not sure why this file didn't upgrade. Should I run the upgrade again maybe?

Thanks again.

[ransclan.com]

And yes I am STILL have the problem with re-directs!!!

[dodgeboard.com]

It's not your site. Your computer is infected with the Win32/InternetAntivirus or Conficker virus. Download Malwarebytes.org, update and scan and remove the browser hijacks.

You keep thinking it's your site, but I am telling you, I spent 20 min on your site with my clean PC, hit about 100 pages, and never saw a popup.

Trust me, I've seen this a jillion times. Your PC is infected. Norton or McAfee will not find it, Malwarebytes will.

[dodgeboard.com]

The full story...

Posted by Ransclan on his own forum...

Two people have indicated that they are getting a "Total Security Protection" pop-up when they open the RANS CLAN forums on their computer.

The hosting company says they have checked and double checked and they can not find any virus on the server.

Just as I opened my Windows Explorer to type this, I got the same pop-up. This is the first time I got it. At least I can see what you are talking about now.

BUT...I got it just as I opened the browser (before I even clicked on the RANS CLAN site)

That tells me that it is not the RANS CLAN site since I get it now just by opening MS Explorer. It is most likely a virus on my computer now activates when I open an internet browser.

I'm still working with vBulletin tech support though to see if there is a way to prevent this.

Here is a link provided by my server on how to remove the "security" virus...

http://www.bleepingcomputer.com/virus-removal/remove-total-security

I just downloaded this free software and it found and removed 20 infected files! You might want to give it a try.

The entire RANS CLAN folder on the server has been scanned more than once and no virus is there. I am told that a virus can be on your computer and something normal on a website can be a trigger to 'awaken' the virus residing on your computer. I'm not computer engineer...that's what I'm told.

vBulletin has an update to the forum software I am going to install but their 'simple' instructions are like trying to read Chinese! It takes hours and hours and hours of back and forth e-mails to tech support to get anything done. I work two jobs and I'm gone half the month so I'm trying to get the new software up as fast as I can. I am hoping the new software, with it's enhanced sucurity features, will eliminate any problems with pop-ups.

As you know my server has scanned the site several times and found nothing. I am very very happy with the customer support I get with this particular server, but I've entertained the idea of switching to a larger, worldwide server-the same one used by Doug Reeves and his Van's AirForce website.

The problem is I would go from paying $125 a year to about $225 a MONTH. Sorry...I just can't afford that.

I have, however, let my server know that the he needs to find the bug on his server or I will have no choice but to switch to another affordable server (if there is one.)

Mark, are you sure the problem is on your server. It has been my understanding that this trojan was on my computer. I am not a computer guy but that's the way I understood it. I would hate to see you chase a gost. I had this trojan on my last laptop and it was not related to the Rans Clan. My son has incountered the same trojan and he has never been on Rans Clan. I wouldn't be jumping servers unless I new for sure. I have McAfee on this computer and it can't find a problem. My wife uses Norton I might try it. If anybody knows of software that will for sure locate and delete it please post who it is. I am not sure I trust the site that you posted, but it may be the only way to remove it. Please tell me if my understanding of this problem is in error.

I think Mark is spoonfeeding information to his host & vBulletin in order to garner support.

Mark, have you ran the Malwarebytes.or scan? What did it find?

[ransclan.com]

dodgeboard.com,

It sound like you think I am making this whole thing up!

I appreciate the effort you are putting in by looking at my site. I DID download, install, and run the Malwarebytes software you recommended. It didn't find or stop anything. (Previously I did download the bleepingcomputer.com software and it did find 20 infected files on my computer but I continued to get the re-direct after running it.)

Yes at first only TWO people indicated the problem. But as time went on I got more and more e-mails from people with the same problem. And it's true at first I never had this problem so I thought it might be in their computer. But then it happened to me also. I had my server scan the entire site and they found nothing. So again, I thought it must be in each individual computer. Then people were telling me that they were only getting it on my site. So then I had no idea what to think!

Then from reading different posts on the vB forum, including YOUR post, it seemed the problem was on the server. So I had the server scan my account again and once more they found nothing.

The thing that's making me run in circles is that the re-direct does not happen every time. But ALL of the people that are getting the re-direct, indicate that it ONLY happens on the RANS CLAN site. (I think later a few people, including myself, got the same re-direct on other sites like Facebook).

Yes I am spoon feeding info to the my forum because I'm trying to keep everyone in the loop about what's going on and what might be done to fix this.

At this point I don't know what to do about it. Is it on the server or isn't it? I have no idea. Since I have upgraded the vB software to 3.8.4 and followed the instructions in this thread, I have not gotten the re-direct at all. However, a guy e-mailed me this morning and said he could surf the web but could not get on the RANS CLAN site because of the re-directs!

Doesn't that make it sound like it's a problem related to my site? AArrgghh this is frustrating!

Anyway, I'm not making this up and I do appreciate the help I receive from this forum. To be honest, if it wasn't for this forum, I never would have been able to upgrade my old .php forum to my new vB forum!

Mark