1911 Beta

Got a complaint that people are getting forwarded to malware sites or something when they try and load 1911. Is this happening to anyone else? I can't replicate it at all, so I'm having a hard time trying to figure out what the problem might be.

Assuming it's brazilian trickery...

I've heard up to like 10 people getting it. Their web browser stops them from even getting here, so they are just closing 1911 so they probably wont see this.

Mother fucker. Thanks.

Probably take the site down for awhile today to try to eradicate whatever the fuck it is.

Name of site redirecting too?

They aren't actually being redirected, they get some warning that 1911 is trying to redirect them to a malware site or something, and it just stops there.

I swear i sent sears a PM with information like the IP address to whatever its trying to do, but i dont see it in my outbox.
3SidedQuarter has it, if that PM didnt go through.

I tried with explorer running in sandbox on lowest security level. It will redirect to some random site promting to install "flash player" in order to view some random celeberty sex video.

Dosen't get redirected when using chrome, opera or firefox, just internet explorer.

Has the httaccess file some input that shouldn't be there? Is the DNS okay?

Narc just sent me this, it might solve something. Dont know if clicking it would be a smart idea. He said this is what his virus scanner pops up as when he tries to come here.

Narc: http://nineteeneleven.org/wp-content/th ... rotate.php
Process:C:\Program Files\Internet Explorer\iexplore.exe
Infection:HTML:Script-inf

Well, what happened is that Dreamhost had an outage last week. Lots of corrupted stuff in the backend since then, so I'm thinking that this stuff has something to do with that. Thanks for the help guys, should be able to get it figured out.

Ok, found a few code injections that looked like they came from a bot, removed anything I could find that might have caused any problems, htaccess is clear.

Can you guys try and see if it's still happening?

defiance: try and go to 1911 on IE
defiance: see if it works
defiance: sears thinks he fixed it
Narc: nope

Narc: Infection Details

URL:http://nineteeneleven.org/
Process:C:\Program Files\Internet Explorer\iexplore.exe
Infection:HTML:Script-inf

Pretty sure this was only happening yesterday? My work AV was blocking access yesterday morning due to "HEUR: Trojan.Script.General" or something along those lines, but I was able to access in the afternoon so I didn't bother messaging you when I was home.

edit: JK. I just tried to access via IE and got the following message:

Kaspersky
Anti-Virus 2010
Access denied
The requested URL could not be retrieved

While trying to retrieve the URL:

http://nineteeneleven.org/forums/

The following threat was encountered:

The requested object is INFECTED with the following viruses: HEUR:Trojan.Script.Generic

Generated:
3:10:47 PM
Kaspersky Anti-Virus 2010

But chrome lets me access fine.

Just tried it Sandboxed in IE too... got redirected again. This time was something about Anti-Virus security installation.

I think chrome is blocking it, while ie(as we all know blows dick) is not blocking it.

I switched to firefox and it works fine.

I found a couple code-injections, but I keep finding more. Looks like they got us site wide. Had to have happened during the Dreamhost "datacenter downtime". Mother fuckers.

But yeah, Chrome/firefox/safari seem to block it, where as it gets straight through with IE.

It looks like I'm going to have to take EVERYTHING DOWN and do clean installs just to get all of the php injections out. That probably won't happen until late tonight.

You cant just roll back?

lolinus wrote:You cant just roll back?

Nope

Sears wrote:

lolinus wrote:You cant just roll back?

Nope

Really no backup?

lolinus wrote:

Sears wrote:

lolinus wrote:You cant just roll back?

Nope

Really no backup?

I think you are misunderstanding what I'm saying. All of the data is backed up, but I have to re-install fresh versions of the two scripts that power 1911 (wordpress + phpbb).

Literally every single php file on the server was injected. I'm assuming via a backdoor in wordpress or phpbb. So, I can't really prevent it from happening again either.

Pretty close to just closing the site down, fuck you cunts.

who the hell uses ie.

toxinatoR wrote:who the hell uses ie.

I am still getting it eric. The plus side is i now know where to go if i want to see pics and vids of raunchy girlfriends...

All I gotta say is...

HAVE FUN

I'd give you more than my single digit rep if I could for your time and effort, but unfortunately the system you designed does not allow me to do so at the present time.


Also, on a sidenote when going to the 1911.org homepage, I notice I end up blocking the following IP:

72.21.91.19

This IP belongs to all of the following sites:

http://www.robtex.com/ip/72.21.91.19.html#ip

I noticed a bunch of wordpress stuff, and malware related sites, among legitmate ones as well. I am not sure how this IP is associated with 1911, but maybe you could shed some light on that.

Edit: more info on that IP: http://malwaresurvival.net/2011/05/11/a ... ware-site/

Schmiggs wrote:I am still getting it eric. The plus side is i now know where to go if i want to see pics and vids of raunchy girlfriends...

I know, I'm not going to be able to get rid of it completely until I take everything down and put it back up from scratch. Literally every php file on the server is infected.

Yay I use chrome/opera (mobile)... Brazi here isn't infected! And Eric don't get mad, have some neat reps!

Firefox wouldn't let me connect to the site a couple times yesterday. Just gave me a timed out error. However it worked on my phone.

Duno if that means anything o.o

Sears wrote:

Schmiggs wrote:I am still getting it eric. The plus side is i now know where to go if i want to see pics and vids of raunchy girlfriends...

I know, I'm not going to be able to get rid of it completely until I take everything down and put it back up from scratch. Literally every php file on the server is infected.

If you haven't fixed this yet then pm me because this can probably get resolved with a fancy sed call, provided you actually have SSH access

Ya I was trying to get on here from work and our symantec was giving me a huge warning and redirecting.