TECH - Malware Issues - 99% Fixed

[Fleet]

Damn im sorry fellas. This sucks. It takes forever for my support ticket to get any help. Even our log in numbers are down. Im guessing members are not able to get on. This kills a forum.

[Formula 21]

Everything's fine on Safari on my ipad.

[ChargingBolts]

Damn im sorry fellas. This sucks. It takes forever for my support ticket to get any help. Even our log in numbers are down. Im guessing members are not able to get on. This kills a forum.

Post on Twitter that it can be viewed by going to google, type in thepowderblues.com then click cached from the drop down button next to search.

[wu-dai clan]

Absolutely no problems at EDGE browser,
on Galaxy S8 or on Sony laptop !!

[NoMoreChillies]

all good here, thanks for keeping the lights on Fleek

Hope the forums comes back up before "hump day" !!

[Fleet]

Almost all browser issues are always Chrome related. Google is so fragile. lol I literally have heard nothing from Godaddy since yesterday afternoon.

Dre Armeda the owner of Sucuri is a Bolt fan. And ive been working with him privately to get my tickets high prioritized at Godaddy. They bought his company.

If you are reading this and cant post or even log in please forgive me. It kills me that we are going through this.

Just know we are not alone. Thousands of Vbulletin forums were hacked. Vbulletin literally has one guy (Wayne Luke) who does all of their technical fixes. He manually installed the patch to close the loophole for hacks.

The problem is the infection. We got a lot of it. And this is what Godaddy has told me.


Your support ticket has been updated.

I've given your site a scan and have found various issues. While I have repaired some of them (see below), your index.php file has been replaced with a malware reference, and we will need a clean copy from backup or vendor distribution. Also, there are some SPAM and malware items in your database that I am unable to clean, so I'm going to escalate this case to one of our senior staff to take a closer look. Thanks for your patience while this is being investigated. We'll keep you posted with any progress that we make.

Update details:

Ticket:	1570229322435
Subject:	Malware removal request - thepowderblues.com
By:	Simon K.

Message:
continuing: Here are the files and directories we have cleaned so far: CLEARED: Cleared malware from file: ./rss.php Details: php.backdoor.base64.002.02 CLEARED: Cleared malware from file: ./inboxgek.php Details: php.malware.generic.027.002 CLEARED: Cleared malware from file: ./index.html.bak.bak Details: js.spam-seo.hidden-style.005 DELETED: Phishing directory: ./captaind, ./my/* There are over 100 database items that need to be evaluated and cleaned.

[Blue Thunder]

I'm using Firefox and haven't had any issues at all. So maybe those that usually use Chrome can access the site through Firefox.

[Fleet]

Yes Google sent us this....

Social engineering content detected on http://www.thepowderblues.com/ To: Webmaster of http://www.thepowderblues.com/, Google's Safe Browsing systems have detected that some pages on your site might be hacked or might include third party resources such as ads that are designed to trick users into installing malicious software or giving up sensitive information. To protect your site's visitors, affected pages have been demoted in Google's search results, and browsers such as Google Chrome now display a warning when users visit your site. You can see which pages might be affected in the Security Issues report.

[Bolt-O]

I use chrome on my little tablet for the site... no issues seen, but I run ad blockers. Firefox on Windows 10 seemed fine, except when trying to open another session of TPB. I never click on ads on sites, and rarely attachments to e-mails unless I had requested them.

[Fleet]

Im using Chrome and have no issues. I use Ublock Origin. But new members accessing us for the first time are going to get google warning them about us being unsafe. And that bums me out. Its just as bad as being blacklisted. We have been through this before and Sucuri cleared it all up within minutes. Godaddy bought Sucuri and in typical Godaddy fashion they are taking their sweet fucking time.

[Velo]

It's virus protection software that is preventing page visits. Norton continues to block my ability to load the page on my laptop. I've been signing in on my phone.

[Fleet]

Can you guys give permissions to use our site in your virus protection software?