I’m continuing to fight the good fight in terms of the malware errors the site was generating. I pulled a second line of (presumably malicious) code from the site yesterday and wanted to collect another round of feedback from you guys to make sure the site is clean.
Last time I checked, Google Chrome was the only holdout still returning errors. I’m thinking we might have done the job for good this time. Again, please let me know what browser you’re running and if you’re getting any errors.
Second bit of feedback I need is in regard to WordPress itself. I don’t know if this has anything to do with the code I removed yesterday, but it now appears I can’t add tags to my blog posts. Does anyone have any idea what might be causing this or know where I should start looking so I can fix it?
Your help is appreciated.
Chrome finally stopped throwing those errors!(for me anyway) No more switching browsers to keep up.
Glad you got it fixed.
With Google Chrome I didn’t see any malware errors pop up today. Usually it will come up one or two times before I can get to the site. Today there wasn’t even one. Let’s hope you got it all finally!
Third viewer chiming in – no errors on Chrome, for the first time in a while. Good work!
I’m using Chrome version 2.0.172.31 on Windows version 3.0.187.0 on OS/X and I’m still getting malware messages on both when I try to enter the Thorum. Here’s the first part of the message that may help your search:
The website at http://www.theaterhopper.com contains elements from the site go00ogle.net
Have you found a lot of other links to go00ogle.net in your pages?
I’m using 3.0.187.1, and no longer getting the errors. FSugino, try restarting the browser or your computer to clear out it’s memory of this page containing errors.
http://www.theaterhopper.com/thorum/styles/xabbblue/template/forum_fn.js line 186, function advQuery is adding go00ogle.net, I would recommend to reinstall the files from a known clean install, and make them read-only on the server. Someone or something seems to be modifying them.
All is working fine for me now. No errors. I use Chrome version 2.0.172.31 in Vista.
Looks like today’s ranking has fallen to pieces. My vote won’t stick. Although, it is nice to be asked to be the first person to vote.
Okay, so now we know the tags, navigation and ranking systems don’t work.
Am I going to have to add back in the code I deleted to get things working again?
UGH! Troubleshooting sucks!
EDIT: I think it has something to do with the Sociable plugin. I just turned it off and I can see that the navigation is now working. Ranking is still on the fritz, though. I don’t know why.
It’s almost 3 pm. Cleared all browsing data in Chrome, restarted, and I still get the same malware warnings about go00ogle on both Mac and Windows. I do see this line in the source of the Thorum page:
Gah, thing ate my code sample. Let’s try this:
<!– ” –>
Bah, I’ll send the bit in email to you, Tom.
Safari is still posting a warning before entering the site.
My Chrome was fine the last time you asked us, but now it’s bad again; one warning for go00ogle, and two for openstat.ws.
Avast is showing up a warning for me now.
I found the advQuery function snuck back into my code this morning. I just removed it and re-uploaded the file. Try things again and let me know if you’re still getting the error.
I’m feeling very helpless because I do not know how to protect against this!!!
No error in Chrome this morning…but you might want to let Joe know that now I’m getting the go00ogle thang trying to view Joe Loves Crappy Movies.
Front page is clean again, but I’m still getting the warning on the Thorum page.
“My Chrome was fine the last time you asked us, but now it’s bad again; one warning for go00ogle, and two for openstat.ws. ” The openstats.ws warning is coming from a iframe from http://www.trafing.net, that is in turn is being added by go00ogle.net
Also, don’t click click or go to any of the domain names I just listed, unless you do it inside a VM, or have JavaScript, plug-ins, and follow meta redirects disabled.
tom, I’ve run into this problem myself on a few of my wordpress installations. That stupid code was embedding itself in my projectwonderful js code somehow and it took me a couple days to find it.
I would suggest chmodding down all the files you can to their lowest levels, and then take a look at every instance of js in your template, there’s likely something that you won’t even realize is wrong there. I ultimately replaced all my adcode and it cleared the problem up, but the code writers are able to obfuscate what they’re doing using some basic js actions.
if you’d like to throw me an IM I can commiserate with you on what should happen to the author of the hax.
I’m going through the exact same problem. Maybe we can help one another? Your main site seems clean. However your “thorum” has the go00ogle.net and traifing.net links malware links.
Sorry to say Tom , but I’m getting the same Malware warning I was getting a couple of days ago (it was fine yesterday though) once again it’s a malware pdf warning that also causes adobe8.0 to shut down!
good luck fixing this
Tian
ps got the first book through yesterday, serious kudos for going to the effort of a decent length comment on each comic! felt like reading the early Bill Waterstone stuff- I just like finding out what artists are thinking about their work. Well that’s enough sycophantic comments for now, but I’ll be buying the rest come payday!