Cockpitbuilders.com

Main => General Discussion Board. => Topic started by: geneb on March 16, 2012, 07:49:57 AM

Title: This site is infected with something...
Post by: geneb on March 16, 2012, 07:49:57 AM
This is the second time this has happened, but the first time I blew it off because I had a couple of dozen tabs open in Firefox.

I hit the site today and nearly instantly got this:

(https://www.cockpitbuilders.com/proxy.php?request=http%3A%2F%2Fwww.geneb.org%2Fimages%2Fcockpit-attack.png&hash=b9370a3139078d455dcde732d5ebcf784d7108e5)

Now I get to scan my whole system to make sure nothing else got in.

I've also just seen a bar show up at the top of the page that says "Loading" in orange with a red close mark to the far right.

You guys need to find out what's gotten in here and fix it fast.

Please send me an email when it's fixed - I won't be back until then.

g.
Title: Re: This site is infected with something...
Post by: Raymondvanderploeg on March 17, 2012, 12:25:45 AM
Just had an similar warning here
Title: Re: This site is infected with something...
Post by: dnoize on March 17, 2012, 12:50:30 AM
norton internet security 2012 also warns and blocks
Title: Re: This site is infected with something...
Post by: saabpilot on March 17, 2012, 02:45:47 AM
Same here !      >:(
Title: Re: This site is infected with something...
Post by: Trevor Hale on March 17, 2012, 04:58:32 AM
Guys,

I am pretty sure I found the problem again...  Let me know if any of you still see any warnings when you come to the site.

Trev
Title: Re: This site is infected with something...
Post by: Maurice on March 17, 2012, 10:27:26 AM
Normally, I also always get warnings when something is not right, but in this latest round, I did not get any warnings at all. Very bizarre.

Maurice
Title: Re: This site is infected with something...
Post by: phil744 on March 17, 2012, 04:31:25 PM
no warnings fo me but has anyone else notice, no matter what explorer your using sometimes u just get a time out error or have to press refresh a few times before the site eventually shows up?
Title: Re: This site is infected with something...
Post by: Trevor Hale on March 17, 2012, 04:35:19 PM
Phil, this is interesting...  I have done quite a bit of work on the site today, perhaps I broke something.  Keep me posted if this continues..

Trev
Title: Re: This site is infected with something...
Post by: phil744 on March 17, 2012, 08:39:14 PM
nah. this was before, probably 2 months or so up until now, tried from several locations, same effect so not PC specific, seems okay tonight...
Title: Re: This site is infected with something...
Post by: Trevor Hale on March 18, 2012, 06:15:03 AM
Hopefully Phil, the faster server will help with that.  Addidionally we will be installing a php accelerator again which we lost when we moved the server last time, so I am sure that will also make things fly better.

Trev
Title: Re: This site is infected with something...
Post by: phil744 on March 18, 2012, 08:15:53 AM
if im honest it has improved over the past few days, however logged on for the first time today and got this :-

(sorry)

Title: Re: This site is infected with something...
Post by: Trevor Hale on March 18, 2012, 08:19:46 AM
Dont be...  Going to hunt some more..  ThanksI will report back.

Trev
Title: Re: This site is infected with something...
Post by: Trevor Hale on March 18, 2012, 09:20:55 AM
Found something very Bizzare, in the Theme Index file..  Hoping the issue is corrected..  But we will see.

Please let me know what you guys experience..  if it happens again, I have a better idea where to look now.  Also, please indicate where the malware pops up, for example what page you were visiting.

Trev

Title: Re: This site is infected with something...
Post by: Bob Reed on March 18, 2012, 12:03:55 PM
Quote from: Trevor Hale on March 18, 2012, 09:20:55 AM
Found something very Bizzare, in the Theme Index file..  Hoping the issue is corrected..  But we will see.

Please let me know what you guys experience..  if it happens again, I have a better idea where to look now.  Also, please indicate where the malware pops up, for example what page you were visiting.

Trev

Have found issues in the theme directory in the past as well. Hmmmmmmm
Title: Re: This site is infected with something...
Post by: fsaviator on March 18, 2012, 06:47:02 PM
My symantec has been blocking traffic from CB.com all day.

Along with that, Iget one, or both of these every time I access CB.com:

[SID: 24280] Web Attack: Exploit Kit Variant 11 detected.
Traffic has been blocked from this application: C:\Program Files (x86)\Mozilla Firefox\firefox.exe

[SID: 25606] Web Attack: Malicious JAR File Download 9 detected.
Traffic has been blocked from this application: C:\Program Files (x86)\Java\jre6\bin\java.exe

Warren
Title: Re: This site is infected with something...
Post by: Trevor Hale on March 20, 2012, 03:15:55 AM
Warren, in case you missed my post yesterday, the orange Loading Bar is the "Auto Save Draft" Feature of the site, nothing to worry about.  that is supposed to happen.

Trev