Forum acting strange, or it's me.

[Deanofid]

Today, when I first opened the forum home page, AVG popped up immediately with a warning, then
popped up again with a notice of "Threat avoided". Since then, every page of the forum that I click
on loads and goes to the bottom of the page. I can scroll up to the subject I want just fine, but the
next thing I click on goes to the bottom of that page, and so on. Even when starting this subject, it
loaded the bottom of the page, and I had to scroll up to the dialog box.

Something is fishy. This started about 1:45pm PST. This doesn't happen with any of the other
websites I usually visit.
Anyone know what is going on?

Forgot to mention, I'm on Firefox. It does the same thing on Google Chrome, but not on IE.

Dean

 

[arnoldb]

I get the same result as Dean, with Firefox on Linux.
I don't have any anti-virus software running on my home Linux box, but same symptoms... - threads jump to the bottom, and I had to scroll up to type this reply.

I Don't get the same problem on other sites....

Did any of the sysadmins upgrade software ? - (I don't yet believe in viruses on Linux :big

Regards, Arnold

 

[max corrigan]

I also have the same problem with Win7 and firefox click on a posting and it goes straight to the bottom of the page, even clicking reply to your posting went to the bottom of the page so Dene your not alone
Max..........

 

[cidrontmg]

I confirm the same behaviour, using Chrome in WinXP. Other sites behave as usual.

 

[kcmillin]

Me too, quite annoying.

Kel

 

[mklotz]

Same here. Firefox 3.6.10 running on XP Professional

 

[student123]

Ditto.

 

[Twmaster]

Wheeeeee! Hack-A-rama....

I'll also report that I am seeing the same rush to the bottom of the page.

Camino on Mac.

 

[Deanofid]

Well, I hate that this has happened, but I'm glad it's not just my machine.

Just before it jumps to the bottom on the page, I get a similar thing to Student345. Down just above the
task bar, where addresses show up for a split second before the page loads, one of the things is
"Lokern.cz.co". I can't catch all of it, as it flashes on and off too quickly.

Dean

 

[GOOFY063]

The same for me with firefox and i just updated to bitdefender 2011 but its not showing anythings going on,oops my bad still scanning and shows 1 threat so far no 2 still has 28 min's left

 

[deere_x475guy]

Got the same Avast warning here. But no problems with jumping to the bottom of the screen. I am on Windows7 64bit and IE8.

 

[gjn]

Down just above the
task bar, where addresses show up for a split second before the page loads, one of the things is
"Lokern.cz.co". I can't catch all of it, as it flashes on and off too quickly.

Dean

A Wireshark trace shows that to be a HTTP Temporary Redirect call to http://lokern.cz.cc/tf/anrvr.php. connecting to the actual domain in a browser returns an "account suspended" page, the full URL refers back to Google. It's unclear why this URL should be needed.

I'm getting the behaviour on FF on XP but not on IE6 on XP.

 

[ksouers]

As you've all surmised already, we've been hacked (again).

I found some of it this morning and removed it, but the site was acting fine. Now I just got home to find this behaviour. I'm working on it.

Dean, thanks for catching that file name. That will help find the little so-and-so.

 

[deere_x475guy]

Kevin, just wanted to say thanks!!!...without guys like you and the rest putting in the extra effort we wouldn't have this fine forum..!!!

 

[zeeprogrammer]

No issues this morning. But now it jumps to the bottom.
When I first logged on I got an Avast - Trojan Horse warning.
Vista, PC

Thanks Kevin.

 

[Twmaster]

Did the cracker get in via a hole in the OS, database or forum software?

 

[Twmaster]

Also, any of you running Windows should update your anti-virus software and run a thorough scan against your computer.

Especially if you did not see any warnings from your anti-virus software. (You ARE running A-V software right??)

 

[Cedge]

Running AV and Spyware scans but nothing popping up here. Behind a physical and software firewalls and nothing jingled.... so far. Firewall log does show one attempted access at 7:00 pm which was about when I went active on the site, but it does not appear to be our boy's work. Not all that uncommon here since I got notified of blocked probing actions fairly regularly.

Steve

 

[Twmaster]

Steve, not everyone has good protection like you. Considering the poor security track record of some software vendors it's a simple thing to be proactive and run scans.

 

[Blogwitch]

My AVG picked it up yesterday evening.

Mine is doing the same as everyone elses, jumping to the bottom of the page.

Is anyone working on it, as it seems just like complaints at this time?


Bogs