PDA

View Full Version : Antivirus pop up when visiting this site


rsquared
12-20-2011, 10:31 AM
I get the following antivirus pop up when visiting the site today. Happens everytime I visit a page on the forum.

http://i8.photobucket.com/albums/a6/r2traps/Untitled-1.jpg
Ogata
12-20-2011, 10:33 AM
I have Eset running too and I'm not getting any issues. HOWEVER, I have no script running and I found a kokosina.in script.
JaYson
12-20-2011, 10:41 AM
Im getting this one:

http://kokosina.in/1
URL: Mal
Ogata
12-20-2011, 10:42 AM
Someone page Ami!!
cwp_sedan
12-20-2011, 10:54 AM
Currently looking into it.
Hyperion
12-20-2011, 11:15 AM
Yup. Also
http://gyazo.com/e5bac0bf36216c73f2773448f6a3e5c5.png
Fuyuzora
12-20-2011, 11:23 AM
Seeing it on NoScript, like Ogata.

Recommend you guys run Firefox with NoScript for the time being (or better yet, all the time... but some people can't be bothered). Scripts which aren't running can't harm you. :)
Mitchell3
12-20-2011, 12:22 PM
Getting this as well. Only on the main page though
nvm just came up again now lol
cwp_sedan
12-20-2011, 12:33 PM
I've found some code in our template files and will remove it soon. I'm not sure if this will fix our problem for the time being but we will continue to look to a complete solution.
cwp_sedan
12-20-2011, 01:49 PM
Anyone still getting the warning? I just removed the code from our templates.
stevenma188
12-20-2011, 02:05 PM
Still getting it.
cwp_sedan
12-20-2011, 02:06 PM
Yeah I figured. ok.
Ogata
12-20-2011, 03:39 PM
Yeah I figured. ok.

How did this get in in the first place?
cwp_sedan
12-20-2011, 03:46 PM
How did this get in in the first place?

That's the bigger question. We are quite behind with our updates. We are supposed to be updating the forum software in January to be current but it seems that we may have been hit by an exploit that affects older versions.
Mitchell3
12-20-2011, 05:28 PM
No more popup for me? haha
cwp_sedan
12-20-2011, 05:30 PM
I removed the conflicting code from the skin templates. I still have to look for the injected file and other stuff. No time to do it though yet.
n00bMeiSter
12-20-2011, 06:21 PM
Google Chrome Incognito FTW!
stevenma188
12-20-2011, 06:22 PM
Still getting the alerts....
SonicBoy
12-20-2011, 08:08 PM
Yup, still getting it at 8:08 PM.
Dave_The_BMXER
12-20-2011, 09:48 PM
I got it this morning and at work so I stopped hitting the page, have not got it now at 9:48
cwp_sedan
12-20-2011, 10:15 PM
Still getting the alerts....


Yup, still getting it at 8:08 PM.

Which skins are you using? There were 2 that still had the code. I just removed it now.
cwp_sedan
12-20-2011, 11:23 PM
Any warnings now for those on PCs?
stevenma188
12-21-2011, 01:15 AM
On the Grey Carbon skin, on PC. So far so good now.
rsquared
12-21-2011, 09:41 AM
Visiting now at 9:40 a.m. no warnings.
SonicBoy
12-21-2011, 09:53 AM
I was using the Grey Carbon skin. So far today at 10:52 AM all appears to be good now.

Thanks



Any warnings now for those on PCs?
Thrizzl3
12-21-2011, 09:54 AM
I was using the Grey Carbon skin. So far today at 10:52 AM all appears to be good now.

Thanks

it isn't even 10 yet LOL :chuckle
cwp_sedan
12-21-2011, 10:11 AM
Good, so far so good.

Please keep me updated for anyone who receives a notification for this in the future.
Dave_The_BMXER
12-21-2011, 10:23 AM
Work seems good now too.
SonicBoy
12-21-2011, 03:51 PM
it isn't even 10 yet LOL :chuckle

See, I knew Ryan was so good I future dated my post.:D
n00bMeiSter
12-21-2011, 04:00 PM
See, I knew Ryan was so good I future dated my post.:D

:No Homo Smiley
cwp_sedan
12-21-2011, 04:12 PM
lol
SonicBoy
12-21-2011, 04:29 PM
:No Homo Smiley

GutterMeister!:chuckle

We all know we're talking about his Computer skills.
n00bMeiSter
12-21-2011, 05:04 PM
GutterMeister!:chuckle

We all know we're talking about his Computer skills.

He doesn't use a computer, he uses fruit. :chuckle :gone