Club Cobra
Page 3 of 13 12 3 4567891011 Last »
Show 20 post(s) from this thread on one page

Club Cobra (http://www.clubcobra.com/forums/)
-   ALL COBRA TALK (http://www.clubcobra.com/forums/all-cobra-talk/)
-   -   this site has been hacked (http://www.clubcobra.com/forums/all-cobra-talk/137679-site-has-been-hacked.html)

moore_rb 12-16-2016 10:34 AM
Quote:
Originally Posted by twobjshelbys (Post 1411451)
I use Firefox on my phone. No such directory on my phone.
The hack is in the native Android browser (which all the other 3rd party browsers actually use to interact with your phone's OS)- I only tested it with Chrome, and removing the goAdSDK folder helped. It must put its scripts in a different location with Firefox.

try closing all apps on your phone, then open your native Android browser (the one with the Globe icon). If the bogus warning pages instantly appear (or if it opens a Play Store window to some bogus ad blocker) before your home page loads, then you are still infected - at which point you can open the settings in the native browser, and clear the cache and all temporary data (this shouldn't impact your firefox cache at all) Then, set your native browser's homepage to a safe destination with a public certificate (https://google.com for example), and restart your phone one more time.


after this 2nd restart - open your phone's native browser again, and try to navigate to club cobra from the native browser... click some links, and see if the issue is cleared up. If it is, then go try club cobra from Firefox, too...

cycleguy55 12-16-2016 10:59 AM
Quote:
Originally Posted by twobjshelbys (Post 1411451)
I use Firefox on my phone. No such directory on my phone.
Ditto, no GOADSDK folder on my phone. That's clearly not the common thread.

Looking my mobile browser history, it appears to originate with a re-direct to serve.popads.net, then the advertisement, warning, etc. pops up. The domain registration for popads.net ( Whois popads.net ) is in Costa Rica and looks like a one-man or small shop (TOMKSOFT S.A.) owned by TOMASZ KLEKOT.

I have reported abuse by popads.net to abuse@enom.com, the "Registrar Abuse Contact Email". The policies posted on the registrar's Web site ( eNom - domain name, web site hosting, email, registration ) look good - but action is quite another matter. We'll have to wait and see if anything changes.

cycleguy55 12-16-2016 11:11 AM
Quote:
Originally Posted by moore_rb (Post 1411457)
The hack is in the native Android browser (which all the other 3rd party browsers actually use to interact with your phone's OS)- I only tested it with Chrome, and removing the goAdSDK folder helped. It must put its scripts in a different location with Firefox.
My native browser is Chrome and, again, no goAdSDK folder on my phone.

BTW, I just checked again and I'm no longer getting pop-ups or re-directs.

joyridin' 12-16-2016 12:12 PM
The browser I use on my Ipad is Mercury. No such folders. The bogus ads appear after the page is loaded and when I go to a forum or to sign in.

No such folder like that on mine either and it only happens on this forum.

mrmustang 12-16-2016 04:36 PM
No issues on my Iphone or Ipads, three separate desktop/laptops, running two different versions of WIN, with four different browsers, no issue.


Then again, I have anti virus and anti malware up the wazoo on everything.......


Bill S

DanEC 12-17-2016 05:22 AM
Interestingly I have a NOOK with internet capability and when I opened it to the Cobra Forum site last night and clicked on a post, the infected notice popped up. Lovely. :mad:

mudhenk27 12-17-2016 05:49 AM
I'm guessin' it's President Putin trying to decide what Cobra to buy ;-)

Blas 12-17-2016 07:38 AM
Still getting the pop-up when I log in on my iPad. "SeeSo" or something is what it says on the pop up. I have erased my cookies, etc. still happens.

twobjshelbys 12-17-2016 07:51 AM
Yep, it happened last night at about 8:00PM PST. I didn't use the phone much yesterday though.

I also noticed that Firefox is asking me to allow Adobe Flash. I don't recall that the site used Flash in the past. Is this related to the problem?

dcdoug 12-17-2016 09:25 AM
Quote:
Originally Posted by twobjshelbys (Post 1411502)
Yep, it happened last night at about 8:00PM PST. I didn't use the phone much yesterday though.

I also noticed that Firefox is asking me to allow Adobe Flash. I don't recall that the site used Flash in the past. Is this related to the problem?
I have seen that FF warning on Flash on other sites. I don't think it is related to the CC site issue. Make sure that your FF is up-to-date though.

twobjshelbys 12-17-2016 10:14 AM
Quote:
Originally Posted by dcdoug (Post 1411517)
I have seen that FF warning on Flash on other sites. I don't think it is related to the CC site issue. Make sure that your FF is up-to-date though.
Not in my case. I have flash disabled because it always wants to play videos automatically and nothing is more annoying when trying to read a site to have video moving (to distract the eyes) and sound (to distract the ears). So I turn off Flash by default and only let it play things I want to see. Now if I could figure out the same for HTML5 (which is what most sites are migrating to)

Brent Mills 12-17-2016 11:17 AM
I'm still trying to figure out what if anything is going on from the site. I am not finding anything to this point. :(

mrmustang 12-17-2016 12:52 PM
Quote:
Originally Posted by Brent Mills (Post 1411528)
I'm still trying to figure out what if anything is going on from the site. I am not finding anything to this point. :(
I'm thinking it is 3rd party banner or embedded link/key word related, as I have yet to have an issue as stated in my other post above.

Looking at the coding (using seamonkey for that) for the main page as well as the main forum page do not show any malicious or out of place coding vs our sister site CHR. Then again, we are using a later version (4.1.3 on CHR vs 3.8.0 here) of the software package there. If memory serves me correctly, we had a similar issue there under an older version of the forum software about a year or year and a half ago.


Just thinking outside the box while looking for a solution or explanation.


Bill S.

mrmustang 12-17-2016 12:59 PM
For those experiencing issues as above, this is what I recommend doing:

1: log out of the forum
2: Clear out your browser and system cache
3: remove the "cookies" for this site from your browser
4: do the same for any back ups you may have
5: make sure you are using the latest version of your browser
6: make sure you have all patches and updates for your operating system (PC, MAC, PHONE) and any anti virus or anti malware programs you may be running
7: reboot
8: log back in

Report back here

On CHR, 95% of the end user reported issues were cleared up with these simple 8 steps. 95%


Bill S

joyridin' 12-17-2016 01:17 PM
Did all that. I was redirected 3 times in a row.

twobjshelbys 12-17-2016 02:32 PM
Quote:
Originally Posted by joyridin' (Post 1411542)
Did all that. I was redirected 3 times in a row.
Me too. I'm pretty sure that the problem is NOT on the client (reader) end but that this server is sending people off to the weeds. And that the problem is not local to the server but at some off-site link that is used to load ad content here. [This assumes that this site has been scrubbed for links to the sites I posted earlier.]

mrmustang 12-17-2016 02:46 PM
Quote:
Originally Posted by joyridin' (Post 1411542)
Did all that. I was redirected 3 times in a row.
Quote:
Originally Posted by twobjshelbys (Post 1411549)
Me too. I'm pretty sure that the problem is NOT on the client (reader) end but that this server is sending people off to the weeds. And that the problem is not local to the server but at some off-site link that is used to load ad content here. [This assumes that this site has been scrubbed for links to the sites I posted earlier.]
You deleted all browser and system cache and temp files?

Are the two of you running any ad blocker, anti virus, or anti malware software?

What devices are you on?
What version of the software (IE: MAC: IOS 9.5, or WIN 95)
What browser are you using? Version?

twobjshelbys 12-17-2016 03:33 PM
Quote:
Originally Posted by mrmustang (Post 1411552)
You deleted all browser and system cache and temp files?

Are the two of you running any ad blocker, anti virus, or anti malware software?

What devices are you on?
What version of the software (IE: MAC: IOS 9.5, or WIN 95)
What browser are you using? Version?
Yes I know what I'm doing. This is an android phone (Samsung S7). All cache and stuff was cleared. On two different systems (phone and Nexus 9) each with two tries. Thanks for your help but most of us have already done all of this. We are in the 5% this doesn't help because it is not on our end.

Additionally, only mobile devices (both iOS and Android) are being attacked because their mission is to sell a store app.

Windows systems are excused this time. Furthermore, it will do no good to try each and every off-site link from a Windows system because it won't show anything. The HTML for this attack is using the platform identifier to trigger the rogue behaviour.

mrmustang 12-17-2016 04:15 PM
Quote:
Originally Posted by twobjshelbys (Post 1411557)
Yes I know what I'm doing. This is an android phone (Samsung S7). All cache and stuff was cleared. On two different systems (phone and Nexus 9) each with two tries. Thanks for your help but most of us have already done all of this. We are in the 5% this doesn't help because it is not on our end.

Additionally, only mobile devices (both iOS and Android) are being attacked because their mission is to sell a store app.

Windows systems are excused this time. Furthermore, it will do no good to try each and every off-site link from a Windows system because it won't show anything. The HTML for this attack is using the platform identifier to trigger the rogue behaviour.
Can't say anything about the Android as I do not have it, but I've now attempted it on 4 IOS mobile platforms of various versions, without an issue


Bill S

twobjshelbys 12-17-2016 04:43 PM
Quote:
Originally Posted by mrmustang (Post 1411559)
Can't say anything about the Android as I do not have it, but I've now attempted it on 4 IOS mobile platforms of various versions, without an issue


Bill S

Not too unexpected. I got through all evening yesterday (6:00 to about 8:00) without a problem then at about 8:00PM last night it happened again. I tried camping on the "new posts" button since that is where it always happens, but I think there is (what appears to be a random) ad that shows up that is the trigger. I do believe there has to be "content" to load, so the empty page if there is no new content the default page doesn't count.


All times are GMT -7. The time now is 09:34 AM.
Page 3 of 13 12 3 4567891011 Last »
Show 20 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.0
Copyright ©2000 - 2025, Jelsoft Enterprises Ltd.
Search Engine Friendly URLs by vBSEO 3.6.0
The representations expressed are the representations and opinions of the clubcobra.com forum members and do not necessarily reflect the opinions and viewpoints of the site owners, moderators, Shelby American, any other replica manufacturer, Ford Motor Company. This website has been planned and developed by clubcobra.com and its forum members and should not be construed as being endorsed by Ford Motor Company, or Shelby American or any other manufacturer unless expressly noted by that entity. "Cobra" and the Cobra logo are registered trademarks for Ford Motor Co., Inc. clubcobra.com forum members agree not to post any copyrighted material unless the copyrighted material is owned by you. Although we do not and cannot review the messages posted and are not responsible for the content of any of these messages, we reserve the right to delete any message for any reason whatsoever. You remain solely responsible for the content of your messages, and you agree to indemnify and hold us harmless with respect to any claim based upon transmission of your message(s). Thank you for visiting clubcobra.com. For full policy documentation refer to the following link: