Kokosina.in - Anyone Else Getting This?

[BadgerDog]

For that particular issue, you need to replace the connection-min.js file. This is the definitive way to fix it. The file should show up as "Does Not Contain Expected Contents" if you run the Suspect File Diagnostics.

Did that as that file was infected as you suggested, however, since our AdminCP settings are configured to have it hosted by Google !!!

So, given that fact, how does one explain how so many vBulletin sites have had that file become infected?

We've now removed the code from all our Footer Templates and also replaced the connection-min.js file, but I'm still not clear on how it happened given our circumstances.

Anyone with any ideas?

Regards,
Doug

[Wayne Luke]

Did that as that file was infected as you suggested, however, since our AdminCP settings are configured to have it hosted by Google !!!

So, given that fact, how does one explain how so many vBulletin sites have had that file become infected?

We've now removed the code from all our Footer Templates and also replaced the connection-min.js file, but I'm still not clear on how it happened given our circumstances.

Anyone with any ideas?

Regards,
Doug

You're using vBulletin 4.1.3. There are several exploits in that version that were fixed in subsequent versions and security patches. You should upgrade to vBulletin 4.1.9. You also need to make sure your addons are up to date so that they don't have potential exploits in them.

[BadgerDog]

You're using vBulletin 4.1.3. There are several exploits in that version that were fixed in subsequent versions and security patches. You should upgrade to vBulletin 4.1.9. You also need to make sure your addons are up to date so that they don't have potential exploits in them.

Yes, we're now using 4.1.3pl5 ...

Understood... so then it is a vBulletin issue with a vulnerable script that has since been addressed in subsequent versions, not someone accessing the site direct through FTP ..

Regards,
Doug

[Wayne Luke]

Yes, we're now using 4.1.3pl5 ...

Understood... so then it is a vBulletin issue with a vulnerable script that has since been addressed in subsequent versions, not someone accessing the site direct through FTP ..

Regards,
Doug

Without access to the site's logs I can't be sure one way or another. However, I would suspect that there is some sort of backdoor installed on your site that was put into place before the security patches were put into place or they have access to the server through another means. vBulletin doesn't have the ability to upload files to the clientscript folder unless additional code is added to the system.

[BadgerDog]

Without access to the site's logs I can't be sure one way or another. However, I would suspect that there is some sort of backdoor installed on your site that was put into place before the security patches were put into place or they have access to the server through another means. vBulletin doesn't have the ability to upload files to the clientscript folder unless additional code is added to the system.

Thanks... appreciate the feedback ...

I'll start looking, but I guess even if we were upgraded to 4.19, if that access is still there, we would still be exposed ...

Regards,
Doug

[Steve038]

Wayne, thanks for all your help with this issue. When updating to 4.1.8, does the file connection-min.js need to be replaced manually, or will this automatically happen when the update is done?

[Wayne Luke]

Thanks... appreciate the feedback ...

I'll start looking, but I guess even if we were upgraded to 4.19, if that access is still there, we would still be exposed ...

Regards,
Doug

The steps that I posted on the first page would help you expose such exposure. Or since you have support ticket access, you can submit a ticket and ask for additional help.

[Wayne Luke]

Wayne, thanks for all your help with this issue. When updating to 4.1.8, does the file connection-min.js need to be replaced manually, or will this automatically happen when the update is done?

It will happen automatically when you upload all the files.

[Steve038]

Thanks again Wayne. This will sound like a strange question, but where do I go to download 4.1.8? When I click the link on the email I received about its release, it takes me to my Members Area, but the only version I can find a link to in there is 4.1.9.

[Steve038]

Just ignore that last post Wayne, I've gone and downloaded 4.1.9 instead.

[Habsy]

Upgrading to 4.1.9 gives me an error at about 76%. Site states it's at 4.1.9 but still have this darn kokosina BS. Really at wits end with this thing.

[Habsy]

For that particular issue, you need to replace the connection-min.js file. This is the definitive way to fix it. The file should show up as "Does Not Contain Expected Contents" if you run the Suspect File Diagnostics.

What folder is this file located in?

[aunesty]

I would like it if perhaps Wayne you could do a complete step by step post of what you want us to try to fix this. The lead lady cleaned up the backend this weekend and then the site got hit again. It is currently running version - 4.1.8 - if an upgrade alone to 4.1.9 will fix this, then great....

What is the exact recommendation of order of possible solutions to this?

Thanks!

[Miss T]

i solved this problem VERY simple

checked FTP for any new files that did not match the latest update-date... in my case the date was 12.19 - and all othr files were 10.30

removed the files...

my files were coms.php and a zero byte install.php ind the root directory

then did a sweep of my templates in vb - we saw this last month with the russian huyndai solaris... exact same thing...

its hidden in the footer and has been kind enough to be easy to find - search for "koko"

remove script... save



and problem solved - all my users report problem is gone

[palmpedia]

i solved this problem VERY simple

checked FTP for any new files that did not match the latest update-date... in my case the date was 12.19 - and all othr files were 10.30

removed the files...

my files were coms.php and a zero byte install.php ind the root directory

then did a sweep of my templates in vb - we saw this last month with the russian huyndai solaris... exact same thing...

its hidden in the footer and has been kind enough to be easy to find - search for "koko"

remove script... save



and problem solved - all my users report problem is gone

Thanks Miss T --- That seemed to do it.

Now the question is - Does anyone know how this got inserted in the first place?