Club Cobra

Club Cobra (http://www.clubcobra.com/forums/)
-   ALL COBRA TALK (http://www.clubcobra.com/forums/all-cobra-talk/)
-   -   this site has been hacked (http://www.clubcobra.com/forums/all-cobra-talk/137679-site-has-been-hacked.html)

Brent Mills 12-15-2016 05:16 PM

Quote:

Originally Posted by twobjshelbys (Post 1411372)
Well... I saw the site go down today and this was one of the first "New Posts" topics so I opened it. No problems on the PC (but there wasn't, except for the Top 10 things). So I opened it on my phone...Not so good:

First, this comes up complete with space age sound effects:

Attachment 29402

Followed by this:

Attachment 29403

Note that this does not happen every time, but I did have to use the "New Posts" to get it. It doesn't happen on the forum index page (or hasn't so far)

I want to confirm that you are still seeing this as of now or was this earlier? Thanks much for the input.

twobjshelbys 12-15-2016 05:21 PM

I looked up the Four Virus on google and it says that the phone is the carrier, yet there were none of the things the "how to remove" article says, and the instructions given to clear the browsers cache and data (forcing me to reenter all my passwords and favorites). Everything was going swimmingly UNTIL I opened the Club Cobra page and I got the exact same thing again.

twobjshelbys 12-15-2016 05:23 PM

Quote:

Originally Posted by Brent Mills (Post 1411377)
I want to confirm that you are still seeing this as of now or was this earlier? Thanks much for the input.

This is happening now, after your query about whether it was or not.

Brent Mills 12-15-2016 05:40 PM

Ok, also so I better understand, as I can't reproduce this myself, you mentioned that you looked up "Four Virus" and it's something that is on your phone? I'm just trying to better understand the issue without being able to see it directly...

Also, is the redirect at the time that you click on "new posts" or after the page loads or somewhere else?

Brent Mills 12-15-2016 05:41 PM

Ok, also so I better understand, as I can't reproduce this myself, you mentioned that you looked up "Four Virus" and it's something that is on your phone? I'm just trying to better understand the issue without being able to see it directly...

Also, is the redirect at the time that you click on "new posts" or after the page loads or somewhere else?

twobjshelbys 12-15-2016 05:45 PM

Note that this only happens on the Club Cobra forum. Other searches indicate if it is on every site then the phone is infected, but if it is only ONE then the chances are it is the site. And they specifically mention AD PROVIDERS!

Your system is heavily damaged by Four virus! pop-up ads | Stay Protected

This makes sense since the variable content at this site is in fact the ads. So it might not be Club Cobra that is infected, but the variable content linked to for the ads. This would apply if the ads in CC are links to other content and not wholly contained within the database of CC itself. Brent, this might be something to look into.

joyridin' 12-15-2016 05:46 PM

It seems to be working fine on my Ipad. The new posts are now showing where they had not been for the past few weeks.

twobjshelbys 12-15-2016 05:48 PM

Quote:

Originally Posted by Brent Mills (Post 1411388)
Ok, also so I better understand, as I can't reproduce this myself, you mentioned that you looked up "Four Virus" and it's something that is on your phone? I'm just trying to better understand the issue without being able to see it directly...

Also, is the redirect at the time that you click on "new posts" or after the page loads or somewhere else?

Looks like we're crossing posts. Before I did the web browser data reset it happened only when I did new posts, but then when I did the reset it was on the first visit to the site and not even in the forum area! It does appear that this "hijacking" is specific to android devices. Again, I suggest looking at the ad content to see if they are bogus. The intermittent nature of the attack could be from the ads since they are random, right?

Brent Mills 12-15-2016 06:05 PM

Well, all of the ads that show on the home page or on the new posts page are controlled by me (the content is not coming from somewhere else) and none of it is popup style....So I'll take a look at the ad content I control to double check there's not something whacky going on there, but thinking about how the system works, I doubt it is that directly. Hmmm....

patrickt 12-15-2016 06:18 PM

A successful remedy on some other sites experiencing the same problem was for the Android user to reset his Google AD ID, which apparently breaks the link on how the adware is delivered to the device.

To do this on your Android phone, go to: Settings > Google > Ads > Reset advertising ID.

Then see if you can get the ad to come up again after hitting the site (like CC) where you were having the problem.

1ntCobra 12-15-2016 07:14 PM

Quote:

Originally Posted by twobjshelbys (Post 1411391)
Looks like we're crossing posts. Before I did the web browser data reset it happened only when I did new posts, but then when I did the reset it was on the first visit to the site and not even in the forum area! It does appear that this "hijacking" is specific to android devices. Again, I suggest looking at the ad content to see if they are bogus. The intermittent nature of the attack could be from the ads since they are random, right?

I had the problem earlier today and I have an iPhone, not an android.

joyridin' 12-15-2016 08:01 PM

I spoke too soon. Took me to a site about medical marijuana, another called pegasus.com, and some site for virus software. 3 times in a row. This is on an Ipad.

Brent Mills 12-15-2016 08:15 PM

Quote:

Originally Posted by joyridin' (Post 1411401)
I spoke too soon. Took me to a site about medical marijuana, another called pegasus.com, and some site for virus software. 3 times in a row. This is on an Ipad.

Are you saying that when you come to this site you are automatically redirected?

RodKnock 12-15-2016 08:45 PM

Quote:

Originally Posted by 1ntCobra (Post 1411397)
I had the problem earlier today and I have an iPhone, not an android.

Depends what IOS is being used too. I had no problems with my iPhone or my PC. My iPad asks me to "block or allow" a pop up, which I block of course.

Brent Mills 12-15-2016 08:54 PM

That is odd then...So far as I know I do not have any popup advertising that could be initiated from my site...I have turned off popup blocking on my browsers and I am not seeing any popups (I do not have IOS or Android). Computers! :(

RodKnock 12-15-2016 09:56 PM

My iPad was an update behind. No pop ups being blocked now.

Ron61 12-16-2016 04:52 AM

Brent,

This is probably not related but three days ago when I logged on using my desktop and two different Browsers, on the top of the Forum page all I could see was the names of the posters. No new threads or posts as all of that was just blank. Now this morning it is all showing up Ok. I also tried my other computer using a different OS and got the same thing.

Ron

joyridin' 12-16-2016 05:25 AM

Quote:

Originally Posted by Brent Mills (Post 1411403)
Are you saying that when you come to this site you are automatically redirected?

I can come to the site, but the minute I touch the screen to go to a forum like All Cobra Talk, it redirects me. I cleared my cookies and history. I could not even log-in on my Ipad this morning. Every time I touched the screen to enter my name, it redirected me to some other spam site.

My home computer seems to work fine, but it has anti pop-up software and all that other good stuff.

moore_rb 12-16-2016 08:43 AM

Guys-

For many of you, this issue is due to some security vulnerabilities in Android. The exploiters are using a built in popup feature in Chrome to display all these "warning" pages which aren't legitimate warnings at all - they want you to click their links, so that they can install even more malware onto your phone.

The quickest way to address this, and still keep all your login and cached data, is to go into your Android's file manager, look for a folder called "GoAdSDK" and delete it; then, do a full shut down/restart on your phone. This android ad-based malware is very tenacious, so don't be surprised if it comes back.

Installing an ad blocker/firewall like DroidWall will also help.


If you are experiencing this issue on an Apple device, then it would be good to know if you are seeing it using the Chrome browser, or Safari? If you are using Chrome, then the solution for you is the same as above- Go find the GoAdSDK folder, and blow it away

twobjshelbys 12-16-2016 09:26 AM

Quote:

Originally Posted by moore_rb (Post 1411440)
Guys-

For many of you, this issue is due to some security vulnerabilities in Android. The exploiters are using a built in popup feature in Chrome to display all these "warning" pages which aren't legitimate warnings at all - they want you to click their links, so that they can install even more malware onto your phone.

I use Firefox on my phone. No such directory on my phone.


All times are GMT -7. The time now is 09:34 AM.

Powered by vBulletin® Version 3.8.0
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
Search Engine Friendly URLs by vBSEO 3.6.0
The representations expressed are the representations and opinions of the clubcobra.com forum members and do not necessarily reflect the opinions and viewpoints of the site owners, moderators, Shelby American, any other replica manufacturer, Ford Motor Company. This website has been planned and developed by clubcobra.com and its forum members and should not be construed as being endorsed by Ford Motor Company, or Shelby American or any other manufacturer unless expressly noted by that entity. "Cobra" and the Cobra logo are registered trademarks for Ford Motor Co., Inc. clubcobra.com forum members agree not to post any copyrighted material unless the copyrighted material is owned by you. Although we do not and cannot review the messages posted and are not responsible for the content of any of these messages, we reserve the right to delete any message for any reason whatsoever. You remain solely responsible for the content of your messages, and you agree to indemnify and hold us harmless with respect to any claim based upon transmission of your message(s). Thank you for visiting clubcobra.com. For full policy documentation refer to the following link: