Malware Warnings on TRs

A couple of folks have sent me PMs/emails about some malware warnings they're getting when viewing the site in Google Chrome. I'm not seeing the same thing in FireFox but there have been some global changes to some of the source files and I'm weeding them out now.

The malware seems to be trying to redirect folks to *.rr.nu websites.

Anyone with more experience here is free to chime in with advice. I'm replacing the edited source files with backups, but I'm not clear yet on the extent of the problem.

Sorry for any hassle. Browse cautiously, I guess.

morning-- i'm getting these now on IE7 at work. i know our IT group has been clamping down lately so i thought it was just part of that.

-mc

Okay I pulled the forum back out of maintenance mode after doing a ton of cleanup. There may be more to root out -- if anyone is still having problems, please post here or PM/email me.

Thanks.

This page still has a script!

Thanks Charlie, tracking it down.

Thanks for dealing with this quickly, Marcus.  Keeping a website running smoothly is not easy in the face of malicious intruders.

I first noticed the issue just after midnight, when the TAY website tried to redirect me to a *.rr.nu website -- this was on Safari on Mac OS X. But I immediately closed the window before it had finished loading the site. However, Safari gave me no warning, and the problem did not recur on a second (tentative) visit to TAY a minute later.

Then this morning at 9am, I got the following warning message when surfing from Chrome on Mac OS X, but Safari was still not warning me.




A few minutes later, you had the forum in maintenance mode, and then by 9:45am, Chrome was no longer giving the warning, and still isn't.

And yes, using the Developer tools in Safari, I can still see a php script from tomoti62veform.rr.nu too.