Kokosina.in - Anyone Else Getting This?

[Steve038]

I can also add that I screen my users very carefully - extremely carefully - and I haven't even admitted any in the last two days. So this exploit is probably getting in somehow other than as a user. I wish there was more info about this.

Yes, so do I. In fact I've closed my site until this can be rectified. I'm a novice at this, and don't want my members machines getting harmed.

Has anyone on here hit by this hack found a suitable cure that has worked? I'd love to know what you did. Are they just targeting vbulletin forums?

[Maurd]

I didn't see it previously mentioned in this thread: Are/were you using any modifications on your forum?

[Steve038]

No, I'm not using any mods. Just the mods the vbulletin program allows, such as colour changes to backgrounds etc. I don't have the skills to try any mods.

[palmpedia]

I believe I have eliminated the issue in the forums by using the Remote YUI option - but I still see kokosina.in is trying to connect in the AdminCP.

[J3rico]

I can confirm most of everything said above.

Some users report warnings, others do not. I installed Kaspersky just to confirm the warnings, and I get none. In fact, I can get no warnings no matter what I do. But I do see a "Connecting to Kokosina.in when loading pages - including AdminCP.

And I can also confirm - someone reported the "Exploit Kit Variant II" warning this morning. I have submitted a ticket, but have yet to receive a response.

I can also add that I screen my users very carefully - extremely carefully - and I haven't even admitted any in the last two days. So this exploit is probably getting in somehow other than as a user. I wish there was more info about this.

Hi, users must delete all cookies, the problem should disappear

I didn't see it previously mentioned in this thread: Are/were you using any modifications on your forum?

Yes, i use modifications on my forum, all updated to the latest released version.

[Colchesterhunter]

I downloaded the suspected connection-min.js from my server and ran kaspersky on it and it showed no virus. I uploaded a fresh connection-min.js downloaded from VB site and when I run Dianostic on the forum to compare files it still says same thing 'File does not contain expected contents' ?? Why would a fresh example still show something wrong ?

[Wayne Luke]

I downloaded the suspected connection-min.js from my server and ran kaspersky on it and it showed no virus. I uploaded a fresh connection-min.js downloaded from VB site and when I run Dianostic on the forum to compare files it still says same thing 'File does not contain expected contents' ?? Why would a fresh example still show something wrong ?

Because your local copy is probably corrupted. When re-uploading files, you should do so from a fresh download.

[Steve038]

Wayne, I had my vbulletin site uploaded by a web developer, on their own computer. I have since downloaded filezilla, and have used this for uploading background images etc, but not any vbulletin updates. I need to update the site to 4.1.8. Are there instructions anywhere as to where I direct the update?

[Wayne Luke]

https://www.vbulletin.com/docs/html/upgrade

[Steve038]

Brilliant! Thanks Wayne.

[Steve038]

One more question Wayne, can i go straight from my current vb 4.1.3 to 4.1.8 or do I also need to add all the updates in between?

[Wayne Luke]

You can update straight. The upgrade script is smart enough to determine your current version and perform all steps necessary.

[Steve038]

Thanks again Wayne.

[Steve038]

Even though my site was uploaded by a web developer on another computer, am I still able to backup my database from my own computer for the purposes of updating to 4.1.8?

[Wayne Luke]

Yes. The database should be on the same server as your files.