Forum hacked?

[chigaijin]

Scripts from various .rr domains are being included at the end of every page. Some of them cause redirects on load. (Check out the page source.)

Not sure exactly how it's working, but probably worth checking out and hopefully patching up?

[Steve]

Maybe it's already fixed, but I pulled up several forum pages' source (including this one) and didn't see any .rr - scripts or otherwise.

[Michele]

I don't see anything, but something seems to be going on or going around. There was another report of antivirus software saying the site is unsafe...

[littlepieceofyoursong]

I've gotten several redirects trying to access the forum recently, though not in the last few days. I was going to scan my computer to make sure it wasn't something in my system causing it before I said anything here. Other folks having run into it makes me think there's something weird, though.

[cmooreNC]

Yeah, I've had repeated redirects to a supposed anti-virus scanning page when I've attempted to access these boards lately. Definitely only this site, but I'm wondering if I haven't somehow got a crummy cookie downloaded that triggers only when I attempt to come here? Blah!

[Michele]

I still haven't seen this at all, but did find a recent article about WordPress blogs getting infected. I've asked Eric to take a look. Thanks for letting us know!

[Michele]

Eric has gotten rid of the bad stuff, but let us know if you guys still see redirects or other weirdness, just in case he missed something.

[chigaijin]

Still here today (or back again). Scroll to the bottom of the generated source on the forum home page. :-(

[Steve]

Still here today (or back again). Scroll to the bottom of the generated source on the forum home page.

I wonder if it might be something in your computer that is affecting generated source. A virus or installed program that does something you're not expecting?

On the forum home page generated source, I find no ".rr" anywhere on the page. The only script on the page is the privmsg one at the top. At the bottom all I show is: the phpBB copyright division with their notice and link, the closing "bodyline" cell tag, the related closing row tag, the related closing table tag, the closing body tag and the closing html tag.

(On this topic page there are additional scripts for sending private messages, but no others.)

[cmooreNC]

Thought I'd check back in. No problem for me today.

Thanks for the "clean up" work!

[littlepieceofyoursong]

Got redirected again this morning, so I check the page source, and this script is what's at the bottom:

<script src="http://penden19tagess.rr.nu/nl.php?p=d"

[Fred]

I just got re-directed at sign-in. Actually, this has been going on for a while. I didn't realize what it was; the isp I'm using here gave me an error message. On my second try it worked.

[Fred]

Still getting re-directs at log-in on the first attempt. Making me very reluctant to use the forum at all.

[Steve]

Maybe you could use the "please keep me signed in" option, however it's worded. At least then you'd avoid that screen.

I did try logging out and back in, though, and still have never had the problem. (Using Chrome with AdBlock Plus on Windows 7 Pro.)

[cmooreNC]

... all the time and it's still happening to me. Only the first time I come to the forum page, though.

Using IE, so that may be my primary problem.