Virus Threat AGAIN!!!

[administrator]

Ads are down, was showing nothing on the VMs last night but taken them down while I look further. Can those of you who were getting alerts let us know if they have gone with the ads removed please.

[Diver]

Ads are down, was showing nothing on the VMs last night but taken them down while I look further. Can those of you who were getting alerts let us know if they have gone with the ads removed please.

Mine has stopped crashing out on refreshing cuk with "This tab has been recovered due to a problem with this web.........etc. etc.

[MarillionFan]

Ads are down, was showing nothing on the VMs last night but taken them down while I look further. Can those of you who were getting alerts let us know if they have gone with the ads removed please.

The ads are gone!

[administrator]

The ads are gone!

Managed to make it into the office now, will see what I can find.

[SimonMac]

Ads are down, was showing nothing on the VMs last night but taken them down while I look further. Can those of you who were getting alerts let us know if they have gone with the ads removed please.

Does this mean that the subs are going up as you no longer have ad revenue? Can I be official CUK Bailiff?

[SupremeSpod]

Does this mean that the subs are going up as you no longer have ad revenue? Can I be official CUK Bailiff?

I doubt you've the cojones! Oi MaryPoppins, We've got a job for you!

[fullyautomatix]

If nothing, these pesky virii have managed to get Ads removed off the CUk forums. It can only be good news.

[SupremeSpod]

If nothing, these pesky virii have managed to get Ads removed off the CUk forums. It can only be good news.

Until Admin decides to stop paying the server fees...

[MarillionFan]

If nothing, these pesky virii have managed to get Ads removed off the CUk forums. It can only be good news.

Until Admin decides to stop paying the server fees...

I've heard rumours that it's a ploy so Admin can start to charge for user accounts to CUK.

£20 per user, so that's AtW and Suity a couple of grand out of pocket each.

[administrator]

Yes, I am a pillock and should not be in charge of a smart phone, let alone a server if the truth be known.

As I said before, the banner ad system got hacked due to the provider (OpenX) getting hacked. This initial hack created a new user account on the system and the hacker logged in to the account via the control panel and added the JavaScript code to the database for each banner entry in a field that can be used to append or prepend the code to the banners.

So cleaned this out, removed the new admin account and changed the password on the main account.

They must have left some sort of backdoor on the file system though as the JavaScript calls were re-inserted into the database for each banner prepend field last Friday. I deleted them out again and saw that OpenX had an upgrade so ran through this as well. This was a complete change of all files on the file system bar the config file. The DB content was not touched though.

This morning I tracked the code down to append and prepend fields in the zone table - the zones are the blocks which you serve ads in. I have checked backups over the last week and these were added to the DB at the same time as the banner ones (Friday) but I missed these when I cleaned the others out and patched the software - these don't appear to have become activate until yesterday for some reason or other.

So with these cleaned out as well I really do hope this is the last of it. If not just raise another forum thread, or if you are feeling really generous send me a PM so I get to see it a bit quicker. I have added a couple of other checks - the prepend and append fields from the banner and zone tables to be emailed to me 4 times a day just in case there is still a route into the server and will also basic auth the admin area later so even if new admin accounts can be injected or passwords revealed somehow they shouldn't be able to get past that to do any damage.