DiscussMormonism.com

Hey, is anyone aware of a problem with chat and a fix? This is what I get when I log in to chat:



I can't see anyone in chat anymore. I've tried with Firefox and Safari, but nothing works.

WAAAAAAAH!

H.

I had the same issue last night. Nothing was showing up. Odd.

There is something else going on also, every time I come to the site I get redirected to some ad page. Is that supposed to ne happening? I suspect a hack.


--edit--
I looked at the source for a couple of the pages and don't see malicious code.

I got the rr.nu redirects also.... That is why I suspect a hack somewhere but I haven't found it yet in the page source.

OK, here's what I've done:

1) Accessed the site on Chrome, Safari, and Firefox. All three have the same problem.
2) Accessed the site on three computers - my laptop, my wife's laptop, and my desktop - all Mac's running Lion, all three have the same problem
3) Every time I refresh any page on the discussion forums, I can see that the site is connecting to a rr.nu domain. The domains are random.
4) Occasionally I am redirected to an ad site.

Shades - you might want to look into this - I have a feeling your site has been compromised and I don't want my computers infected with malware.

H.

It attempts a redirect when I initially open the page, but my system prevents it and I just have to load the page again and it's fine.

maklelan wrote:It attempts a redirect when I initially open the page, but my system prevents it and I just have to load the page again and it's fine.

Same here - it attempts to connect to an rr.nu subdomain, but it's not successful. Although this is not good - it means that this site is infected.

H.

LDST is right, someone is going to have to look at the HTML code. I bet if you checked cached versions of this site you could find the culprit hiding behind something like a height:0; width:0 style.

I am digging into some of the page source and not finding the redirector but see it when I analyze the page in wepawet. This may be at the isp/hosting level.

I just scanned the site using this tool: Sucuri SiteCheckand found the following script is installed:

http://mputer94izeduni.rr.nu/mm.php?d=1

This needs to be removed from the site. NOW.

H.

Look for any obfuscated java script and anything with an iframe call. I have fed some of the pages to jsunpack but have yet to find the redirector in the page source that I am able to retrieve, again this may be at the host level eg dreamhost is hacked and throwing on the redirect, or the web server, yada yada. Usually I can find redirectors pretty easily, but as I am at work I am running this analysis on my phone.