Is anyone else getting rerouted from GSUS to a virus program when you use Google?

[ximmy]

I believe someone at Google has targeted our site and redirects persons who click on our link that google provides.

This does not happen with any other search engine, only google.

So when a stranger tries to open GSUS web page from google they are directed to download a virus.

This keeps people from finding us.

If I close the virus window and reclick GSUS it directs properly.

About 43,300,000 results (0.34 seconds)

Search Results

Gold-Silver Forums - Gold-Silver.US

gold-silver.us/forum/

gold, silver, platinum, palladium, precious metals. ... Forum description. Gold, Silver, Precious Metals. (9 Viewing). Discuss gold, silver and other precious metals ...‎General Discussion · ‎Rosa "Rosie" · ‎Gold, Silver, Precious Metals

Attachment 8879

[Joshua01]

Strangers? We don't need no stinkin' strangers!

[Jewboo]

https://www.google.com/search?q=gold...IBygA&dpr=1.25






SECOND LINK HAS THE filestore72 HIJACK

[vacuum]

https://www.google.com/search?q=gold...IBygA&dpr=1.25






SECOND LINK HAS THE filestore72 HIJACK

When I use firefox 44.0 on lubuntu 12.04, it all works the way it should. No redirect.

edit: I also have Adguard and Adblock Edge installed

[crimethink]

This has happened to me twice in the recent past. I definitely clicked on www.gold-silver.us/forum and not an alternative link in the search results. I normally just use the link in Firefox's frequently visited sites, though.

[Atocha]

https://www.google.com/search?q=gold...IBygA&dpr=1.25






SECOND LINK HAS THE filestore72 HIJACK

This is a hijack bug in vbulletin forum software. Google filestore72 and vbulletin. It is not your browser.

[ximmy]

This is a hijack bug in vbulletin forum software. Google filestore72 and vbulletin. It is not your browser.

So the site owner can fix it?

[Atocha]

So the site owner can fix it?

I am sure it is possible.

[Jewboo]

This is a hijack bug in vbulletin forum software. Google filestore72 and vbulletin. It is not your browser.

The cure needs to be provided by our slumlord JQP:

Flish

01-02-17, 22:02

This is complex, but basically at some point a vulnerability has compromised the site and allowed code to be Injected server side into the pho scripts that power the site.

The injected code has some logic that says 'if the visitor has come from a search engine and this is their first visit then inject this JavaScript code into the page' - the injected code redirects us to the dodgy site, and is why we can't see it by viewing source and most of us are unaware, but if you kill cookies and run a script to capture output by pretending to have been referred by google you can capture the code.

The fix is for the site owners server side, vulnerability needs fixing and the php scripts cleaned up, good news it's fairly obvious to a capable Deb what the dodgybcode is, bad news is it could have been injected into 100's of files, *sometimes* you can automate cleanup, but it will happen again if you don't fix the entry point

not sure who to signpost this too, but happy to help if someone reaches out



Robert Burns

02-02-17, 05:02


Hi all,

Apologies for that, but hopefully it is now all resolved.

Cpanel upgraded
LiteSpeed server upgraded
PHP upgraded.
Site software upgraded
All server side passwords have been changed.

So hopefully we are all back to normal. If anyone see's anything dodgy, feel free to report it. The Mods all have my email address.

I can confirm it was a redirect file in the structure not an SQL injection, still not sure how they got it in the file structure, but it's gone now. You'll see that all references to the file name have been changed, I then downloaded a dump of the database and did a search, so I know we were not infected database side.

I've done a google search and clicked all the links and only come here. I urge all members to clear their cache on their browsers.

If you want to be belt & braces safe a password change is never a bad thing, though as I said before, I am content that they did not breach the database, and so no information was lost.

Once again, apologies for the inconvenience.

[crimethink]

This is a hijack bug in vbulletin forum software. Google filestore72 and vbulletin. It is not your browser.

The redirect happens at Google, so either Google and/or their CDN is causing it, not GSUS or its vBulletin suite.