Virus from this website

[gunwolf]

here is what I am getting, maybe it's nothing and I should ignore...but I have been infected and wiped clean twice in one week. no other sites give me this warning.

[minderasr]

I switched to MS Essentials from Avast and I'm still not getting any warnings. I don't think it's the site.

[Wildman1024]

im getting a virus warning again.

JS/Kryptik.LP Trojan

[Rich]

I'm away until this evening but will shut the site down for a few hours again and scan everything again. I replaced all of the files on the forum with new copies so I find it hard to believe there is still a virus but I just sent another email to tech so we are working on it.

[John D]

here is what I am getting, maybe it's nothing and I should ignore...but I have been infected and wiped clean twice in one week. no other sites give me this warning.

I'm getting the same notice as "gunwolf". I'm using "Norton Anti Virus".

[Wildman1024]

Here is the pic of mine

[Koi]

Yep I'm getting the warning from avast again when I come to the forums.

[Chris123NT]

I'm not getting any warnings anymore, haven't been since the issue was resolved a few nights ago

[Rich]

It is definitely strange but I am going to shut the forum down for the night and and check every individual file for any viruses, etc.

[Rich]

A: Rich,

All the files we found today - were dated; Apr 6, 13:58 server time (PST).

We did the restore for you on Apr 3rd; it's unclear if you were able to successfully get upgraded to vB 4.1.11 ; as you reported still having problems and missing files on Apr 7th.

So in the "how are they getting in" - I'm tempted to say - now that we know we have a fully cleaned - and fully patched vBulletin 4.1.11 - let's see how things go.

On the "fully cleaned" front - we also found this file was also modified; we reverted this back to the known working version you provided.
/forum/install/vbulletin-upgrade.js

Finally we found a small number of files that are present in your nyshooters.net/forum - directories that are not in the uploaded files you gave us.

Most of them make sense - the list is below.

However this one file ( which was also modified in the same way with encrypted data ); does not appear to belong in this location at all; we went ahead and deleted it.

/forum/includes/vbulletin-threadlist-ie.js

The real file appears to be located in:
/forum/clientscript/vbulletin-threadlist-ie.js


Each of the following files should be closely inspected; but we already did a file by file check - visual inspection of each file did not show any of the same style of encrypted data - that other hacked files included. ( since this hack uses a data encryption method - our normal Anti-Virus software does not find anything - which is why we need to visually "look at" each and every file ).

Anyway all of the following appear legit - but you may want to take a 2nd look just in case.

Only in ../nyshooters.net/forum/admincp: itrader_misc.php
Only in ../nyshooters.net/forum/images: graphics
Only in ../nyshooters.net/forum/images: itrader
Only in ../nyshooters.net/forum/includes: class_dm_itrader.php
Only in ../nyshooters.net/forum/includes: config.php
Only in ../nyshooters.net/forum/includes: functions_itrader.php
Only in ../nyshooters.net/forum/includes: functions_itrader_urlcheck.php
Only in ../nyshooters.net/forum/includes: itrader_detail.php
Only in ../nyshooters.net/forum/includes: itrader_feedback.php
Only in ../nyshooters.net/forum/includes: itrader_global.php
Only in ../nyshooters.net/forum/includes: itrader_main.php
Only in ../nyshooters.net/forum/includes: itrader.php
Only in ../nyshooters.net/forum/includes: itrader_report.php
Only in ../nyshooters.net/forum/includes/xml: bitfield_itrader.xml
Only in ../nyshooters.net/forum/includes/xml: cpnav_itrader.xml
Only in ../nyshooters.net/forum: itrader_detail.php
Only in ../nyshooters.net/forum: itrader_feedback.php
Only in ../nyshooters.net/forum: itrader_global.php
Only in ../nyshooters.net/forum: itrader_main.php
Only in ../nyshooters.net/forum: itrader.php
Only in ../nyshooters.net/forum: itrader_report.php

Everything else now matches the exact file/directory structures you uploaded to us - so your forum appears clean.

-Michael

The forum is once again virus free or at least it should be. If you come across any virus notices again let me know. We're still not sure how they "got in" but we believe it is taken care of at this point.