MALWARE on zerotohundred

[pcmoddingmy]

I'm having the same problem too... since when ZTH has been "Reported Attack Site!"?
Note that this only happens when browsing using Mozila Firefox. Tried using Internet Explorer and no such problem. I guess Firefox is somehow reporting to www.stopbadware.org that ZTH is an "Attack Site".
Admin, please do something bout this. Thanks!

For ZTHians, you may temporarily switch to IE to prevent from this annoying alert. Note that this has nothing to do with your antivirus application.

 

[Tom]

hi everyone, thank you for the notification,

we've been fixing this issue since morning and have successfully removed the threats.
it was the files that were infected. it will take a few moments for google to re-verify zerotohundred.com and be removed from the block list.

There has also been a few attacks recently, so we'e trying hard to secure the site to prevent future attacks.

I apologize for the inconvenience this may have caused anyone.

Thanks!
Tom

 

[BLaCkHoWLiNG]

Tom: keshy used the server to surf porn issit?
LOLOLOL

*cabut*

 

[shawnzz]

im still getting it on chrome browser, i only can browse zth on IE .

 

[sprOc]

Yep, still getting the warning some mins ago with my Firefox.

incase you guys wanna know how to temporary remove the warning in Firefox, go Tools -> Option -> Security and untick "Block reported attack sites".

but please don't surf porn with the setting off. lol

 

[loose_end]

I am no longer facing the threats ..

 

[Niemans1116]

hi everyone, thank you for the notification,

we've been fixing this issue since morning and have successfully removed the threats.
it was the files that were infected. it will take a few moments for google to re-verify zerotohundred.com and be removed from the block list.

There has also been a few attacks recently, so we'e trying hard to secure the site to prevent future attacks.

I apologize for the inconvenience this may have caused anyone.

Thanks!
Tom

Thanks to Tom and admin team,

IT'S BUSINESS AS USUAL!!!:top:

 

[ioki]

Great tom for the prompt action. Keep it up!!!!

 

[papagoines]

erm... mister administrator.. sir...

could you re-verify since I just receive the warnings from chrome.. just this moment

 

[Niemans1116]

Tom,

This morning about 0400 hrs my AVG9.0 blocked the page in Marketplace Categories: Interior & Cockpit.

 

[^pomen_GTR^]

my newly installed chrome detected malware again on all zth...today...

 

[kanan]

me too

 

[Tom]

hi everyone, thanks for replies,

we've been attacked yet again. the files are scanned and removed at this time.

If your antivirus prompts a mesage, I would appreciate it greatly if you could post the messages here

thanks!

 

[ShaolinTiger]

You're still using vBulletin 3.8.5 which is a vulnerable version. I suggest upgrading to 3.8.6 Patch Level 1 which is the latest stable version in 3.8x tree.

 

[Tom]

hi shaolin tiger,

thanks for the recommendation, we'll be upgrading soon to the latest patch.
though the affected areas were in fact not vbulletin this time but the openX adserver

Thanks!
Tom

 

[ShaolinTiger]

Ah, no worries. Best to keep everything up to date just to be safe.

You might wanna implement some more security measures on the server side too as I presume you're on a dedicated servers. Things to check out:

SuPHP - http://www.suphp.org/Home.html
Suhosin - http://www.hardened-php.net/suhosin/
mod_security - http://www.modsecurity.org/
CSF - http://www.configserver.com/cp/csf.html

All make sure all the permissions are correct (not 777) and scan the machine with chrootkit or similar.

There's also some tips here regarding OpenX specifically:

http://www.openx.org/fr/docs/2.8/adminguide/Securing+OpenX

You probably got this too:

http://www.thewebhostinghero.com/articles/openx-vulnerability-this-site-may-harm-your-computer.html

 

[kian27]

my avast detected virus just now..isit kena attacked again?

 

[Tom]

hi kian27

would you by any chance have the report with you?
this would help us detect the infected files better

Thanks!

 

[kian27]

this 1? if nt mayb other avast user can tell me where/how to find it, i will try my best. Those at july 1 is zth affect by malware period also. That time i thought was my pc problem so i just ignore it until other forumer file a report at here i just realize.

last time when here is affected by malware when i log to zth page then avast will warn me & something about java will pop up (i didn't read it just close the pop up). hope it helps.

 

[Tom]

hi Kian

thanks for the reply
do continue to update us if you find any future notices

There was in fact a suspicious JavaScript file earlier which we've fixed.

It's now 100% safe. Your anti-virus shouldn't show any more pop-ups

thanks!
Tom