Kokosina.in - Anyone Else Getting This?

[Wayne Luke]

You would re-upload the file from the vBulletin package you downloaded. Using FTP. Just like the file was installed on your server to begin with.

[Steve038]

A couple of my members have now informed me they are getting attacked coming to my site. I'm going to have to close it down, as my own computer has been hit with a Trojan, which now seems to be associated with whatever has attacked my site so its in the shop getting repaired. So I can't install anything until I get it back.

I have just done the Diagnostics check, as above, and found 3 files that vbulletin says "File not recognized as part of vbulletin". They are: commons.php, coms.php, feetp.htm, plus another 3 which are listed as "File does not contain expected contents". They are: connection-min.js, blank.html, and subscription_editfolders.php How do I delete these?

Also, once repaired, whats to stop the exact same thing happening again?

This is stressing me out! I don't want my members to be scared of visiting my site. And how did this happen in the first place?

[Steve038]

How do I go about closing my site until I've repaired it? ie, something that says the site is closed for maintenance or similar?

[Wayne Luke]

Settings -> Options -> Turn your vBulletin On or Off.

You should open a ticket for further diagnostics. Viewing your site homepage (CMS) and the Forum Home Page, I get no such warnings and there is nothing in the source code that would indicate such a trojan or exploited code. Could be user submitted content though. In the ticket, provide the exact URL that users are getting the warning on.

[Steve038]

Thanks Wayne, what do you mean by "open a ticket"? Sorry, I'm new to this.

I'm on Avast, and every page I go into on my site on our second pc brings about a pop-up from Avast telling me a threat has been detected. Its the same Kokosina that has been on the site for a few days: http://kokosina.in/t/go.php?sid=5

[Steve038]

Wayne, I spoke with my service provider, and they said they could see pop-ups when viewing my site also. I've never added pop-ups myself.

[HeLLRZR]

Some of my users are reporting the same thing, however when I visit your website or mine I do not get an alert. However I am running Microsoft security essentials and not avast.

[J3rico]

Hi all, same problem in my forum, today only in the administration panel and moderator panel, yesterday on every pages of the forum.
Antivirus used : Avast and Kapersky.
Vbulletin Version : 4.1.8
Vbseo : 3.6.0 Gold

[Steve038]

Wayne, what is a support ticket? How do I open one?

[Wayne Luke]

Wayne, what is a support ticket? How do I open one?

A support ticket is how you get access to our email and priority support. You open one by clicking the "Support Ticket System" link in your member's area. The forums are a lower priority of support.

[Steve038]

Do I go into my control panel area to find this Wayne?

[Recep Baltaş]

Members on my forum are getting attacked too. What I don't understand is why when I log on to my own forum I am not attacked and Kaspersky does not show a warning box. However when I just look at Trevours website it brings up the warning ?

I followed your advice on my site with 1) Run Suspect File Diagnostics under Maintenance -> Diagnostics. Replace any files not containing the expected contents. Delete any files that are not part of vBulletin and that you can't identify as belonging to your addons.


There were two files I deleted, but one 'connection-min.js' says file does not contain expected data. How do you replace this file ?

I have tried reading up on 'injection hacking' but am confused as to how this achieved. Is my SQL database corrupted now or is it a front end hack using someone elses ID ??

Try my webiste and see if you get the warning as I don't but members do ?

http://www.colchestertreasurehunting.co.uk/detecting/

Dude, are you serious? Why in the world are you using version 4.0.0? You have severe vulnerabilities in your system. Have you installed patches?

//Why and why people keep using the old version when there is the latest for free!!

[Steve038]

J3rico above is using 41.8 and he has been hit too.

[J3rico]

J3rico above is using 41.8 and he has been hit too.

exactly, meantime i re-upload the file from the vBulletin package, but no luck.
I upgrade my Firefox to version 8.0.1 and now kapersky give no error ...will be a case?

[Wayne Luke]

Do I go into my control panel area to find this Wayne?

https://members.vbulletin.com/