Calendar
Members
Search
Help
RSS Feed 
 Malware Served With Ads, malware served with ads |
  |
 Jul 4 2010, 12:58 AM
Post
#1
|
|
|
Advanced Member  Group: Members Posts: 34 Joined: 11-February 06 Member No.: 9,919  |
I'm getting several different people letting me know that their antivirus/spam blockers are stopping infection attempts of Antivirus 2009 malware. I've scanned my server and had my hosting company check it as well. Google doesn't complain either. I suspect that openx is serving malware code with banners. Is anyone else having this issue?
|
 |
 
|
|
Jul 6 2010, 06:04 AM
Post
#2
|
|
|
Member Group: Members Posts: 12 Joined: 23-November 05 Member No.: 8,540 |
Hi, have you updated to openx 285? I had the same problems and the only solutions I could find was to upgrade, my version was 2.81.
|
|
|
|
|
Jul 6 2010, 03:25 PM
Post
#3
|
|
|
Advanced Member Group: Members Posts: 34 Joined: 11-February 06 Member No.: 9,919 |
QUOTE (keledan @ Jul 6 2010, 07:04 AM)  Hi, have you updated to openx 285? I had the same problems and the only solutions I could find was to upgrade, my version was 2.81. I use the openx.org not stand alone version |
|
|
|
|
Jul 19 2010, 07:47 PM
Post
#4
|
|
|
Member Group: Members Posts: 13 Joined: 20-November 07 Member No.: 19,091 |
Hello, I am having the same problem here, also using the hosted version of openx (openx.org).
|
|
|
|
|
Jul 27 2010, 09:07 PM
Post
#5
|
|
|
Member Group: Members Posts: 19 Joined: 24-November 08 From: Austria Member No.: 24,344 |
QUOTE (svsanchez @ Jul 19 2010, 08:47 PM) Hello, I am having the same problem here, also using the hosted version of openx (openx.org). So the hosted version is serving malware as well? I was just thinking about switching to hosted from my stand-alone (which is up-to-date 2.8.5 but still gets hacked every other week). So that's not going to be an improvement then.. |
|
|
|
|
Jul 31 2010, 08:16 PM
Post
#6
|
|
|
Advanced Member Group: Members Posts: 85 Joined: 29-September 09 Member No.: 53,221 |
are you all opted-in to the Ad Market? other people have complained about this in other threads.
|
|
|
|
|
Aug 23 2010, 05:20 AM
Post
#7
|
|
|
Beginner Group: Members Posts: 2 Joined: 26-April 04 Member No.: 1,889 |
they found me too. Not a member of openx market.
What they did to me was inject a zero pixel iframe into the banner append language ...(first time) and the pre-pend field the second time. I upgraded after the second and now notice a big difference in how the software operates. Thought I'd see the issue here. I think someone compiled a list of openx ... maybe hacked the registrations here ... and did a little research. With a well placed hack, they could do well, the frigging criminals. GP Hughes |
|
|
|
|
Oct 5 2010, 11:08 AM
Post
#8
|
|
 Member Group: Members Posts: 11 Joined: 26-November 07 From: Krefeld Member No.: 19,167 |
Just run this SQL query to clear all (!) append/prepend tags:
CODE UPDATE `ox_banners` SET `append`='',`prepend`='' On my server, the IFRAME included a "in.cgi" which is hosted on a .co.cc domain, which seems to be protected and only redirect to a JavaScript (helpctrall.php for my side but they seem to randomize these script names) which calls a hcp:// link. According to one of my users it tries to "install something into Windows Media Player". I have analyzed the HTML code generated by the helpctrall.php script, it looks like that it tries to force the Media Player to download load.exe which is a win32 binary (I do not execute that on my Wine installation). So far with my investigations. I *think* the cracker (not hacker, please!) was able to intrude my server through the scripts in www/delivery/ which were not yet (but now are) protected by Cracker Tracker Standalone (see my SVN download link http://www.ship-simu.org/repos/ctracker/trunk/ for details). As I know these files got flushed (right?) and therefore the little line require('ctracker.php'); got removed from it. Can I somewhere add it so it will always be included? |
|
|
|
|
Oct 8 2010, 07:38 AM
Post
#9
|
|
|
Beginner Group: Members Posts: 6 Joined: 17-January 10 From: Sydney Member No.: 85,001 |
QUOTE (quix0r @ Oct 5 2010, 12:08 PM) Just run this SQL query to clear all (!) append/prepend tags: CODE UPDATE `ox_banners` SET `append`='',`prepend`='' On my server, the IFRAME included a "in.cgi" which is hosted on a .co.cc domain, which seems to be protected and only redirect to a JavaScript (helpctrall.php for my side but they seem to randomize these script names) which calls a hcp:// link. According to one of my users it tries to "install something into Windows Media Player". I have analyzed the HTML code generated by the helpctrall.php script, it looks like that it tries to force the Media Player to download load.exe which is a win32 binary (I do not execute that on my Wine installation). So far with my investigations. I *think* the cracker (not hacker, please!) was able to intrude my server through the scripts in www/delivery/ which were not yet (but now are) protected by Cracker Tracker Standalone (see my SVN download link http://www.ship-simu.org/repos/ctracker/trunk/ for details). As I know these files got flushed (right?) and therefore the little line require('ctracker.php'); got removed from it. Can I somewhere add it so it will always be included? Thanks, quix0r, the sql code you've provided, has saved me a lot of clicking! 
|
|
|
|
 Oct 8 2010, 08:17 AM
Post
#10
|
|
|
Beginner Group: Members Posts: 4 Joined: 8-October 10 Member No.: 144,001 |
my version of open x was 2.8.1, i've got the same problem with google since two days…
i uprgrade my version to 2.8.7 yesterday, and i run the sql script today… i hope this will repair my Google avertissement. |
|
|
|
|
Oct 8 2010, 08:34 AM
Post
#11
|
|
|
Beginner Group: Members Posts: 1 Joined: 10-May 10 Member No.: 116,851 |
I'm experiencing the same problem with my websites.
Google phishing alert include ! I'm trying to download the 2.8.7 but the openx website displays error messages on the page. I ran the SQL routine. Is it enough ? What more can i do ? Thanks for your help. |
|
|
|
|
Oct 8 2010, 09:12 AM
Post
#12
|
|
|
Beginner Group: Members Posts: 4 Joined: 8-October 10 Member No.: 144,001 |
QUOTE (tof75017 @ Oct 8 2010, 08:34 AM) I'm experiencing the same problem with my websites. Google phishing alert include ! I'm trying to download the 2.8.7 but the openx website displays error messages on the page. I ran the SQL routine. Is it enough ? What more can i do ? Thanks for your help. Waiting for help too |
|
|
|
|
Oct 19 2010, 09:51 AM
Post
#13
|
|
|
Beginner Group: Members Posts: 2 Joined: 18-October 10 Member No.: 145,571 |
Also facing this problem on 2.8.5 stand-alone. Will an upgrade to 2.8.7 fix this problem?
thanks |
|
|
|
|
Oct 23 2010, 07:44 PM
Post
#14
|
|
|
Beginner Group: Members Posts: 2 Joined: 28-September 10 Member No.: 142,321 |
QUOTE (samurai @ Oct 19 2010, 09:51 AM) Also facing this problem on 2.8.5 stand-alone. Will an upgrade to 2.8.7 fix this problem? thanks I am having this problem today on 2.8.7 stand-alone. I'm forwarding this thread to my support people. Is there any other help anyone can give me? |
|
|
|
|