The Rover-Landers of BC

There seems to be some sort of issue going on with the website. It's being reported by some virus and malware checkers as "Exploit Blackhole Exploit Kit type 2160" and indeed there is some missing data, for example the Links and Supporters pages. I'm not sure if this is a hack or something wrong with the provider or the server its hosted on.

When I get time in the next few days I'll look into it further. I have backups of the entire site so we haven't lost any data.

Dave

Backups of the photo gallery and forum now complete as well. I've put together a temporary simplified version of the website. If you're still getting warnings in your browser about Blackhole Exploits, let me know what page the warning popped up on.

thanks, Dave

Thanks for working on this Dave, I'm sure its just what you wanted to do on such a sunny weekend!...

Cheers, Andy

My virus scan is sending alarms on the forum page header detecting a trojan when I open the forum page... yikes!

still getting black hole warning - 4:2 pm wed

I shut down the forum at 8:30 tonight to do a software upgrade. As of 10:40 the site is back up and running. This should do away with the last of the corrupt files we had. Please let me know if you're still getting warnings, however info about the Blackhole Exploit indicates that you may see warnings for up to 90 days after the problem has been cleared.

thanks Dave

Hi Dave

While I hopefully located all the viruses I still get lines of text above the masthead on the main forum page:

[phb BB Debug] Warning in file [ROOT]/including/function.phb online 4668 and then repeats but for 4670, 4671, 4672

Cheers
Ted

I am recieving dozens of emails from 66rover99@gmail?

Hi Dave,
Like Paul I am receiving dozens of emails from your address 66rover99@gmail? I'm just deleting them.
Thanks for your hard work trying to rectify these issues.
Bill

sailourboy wrote:Hi Dave

While I hopefully located all the viruses I still get lines of text above the masthead on the main forum page:

[phb BB Debug] Warning in file [ROOT]/including/function.phb online 4668 and then repeats but for 4670, 4671, 4672

Cheers
Ted

Hi Ted,

I called back the programmer and he said he had some trouble restoring all of our postings and had put it into debug mode, and then forgot to take it back to normal mode. He has corrected it now so there should be no more debug messages.

Dave

Bill E. wrote:Hi Dave,
Like Paul I am receiving dozens of emails from your address 66rover99@gmail? I'm just deleting them.
Thanks for your hard work trying to rectify these issues.
Bill

Hi Bill and Paul,

Its cuz I like you guys so much! I've heard from a few others as well that they're getting this. It looks like when we recovered from the backup of the old database to this new one that there was a pile of undelivered mail that got re-sent out. Hopefully it dries up in the next day or so.

BTW, are you getting alert emails when I responded to this? I'm not so wondering if others are getting the regular alerts or if theres something else that not yet configured right.

Dave

Hi Dave...10-4 on why I'm getting emails...but negative on the topic reply notification email.

PaulC

I think my programmer friend has gone away for the weekend as he's not responding to my requests. Hopefully by early next week we'll have the rest of it sorted.

Dave

Hi Dave,

Still getting threat detections this morning and the lines of code at the top of the forum home page & when I open new sections.

Cheers,
Andy

Yee Haaw.... after a week unable to open the Forum its now back to normal, :bounce: with a new fresh look !

Good work Dave .... :cheers:

Avatar Photos now working again. So are the Land Rover smilies.

:rev:

Dave

Woo hoo.... all clean now :D

Cheers Dave....

I'm still having trouble accessing the website, all I get is "access forbidden". If I search for the forum on google I can get in that way but I cannot get trough the website? Any one else have this? I'm using Firefox web browser.

Matt

Finally got it working. I had to clear all my "cookies"

Matt

Still getting a dozen or so emails every day, if this temporary, how temporary or how can i stop it immediately. It is becoming annoying.

I'm out camping and very surprised to have Internet. For the moment I've turned on the previous versions Q and A at registration rather than the funny letters. Seems like the robots can figure out the letters as since the upgrade we've been deluged with spam users. Funny thing, Paul, you're not even a site admin or moderator, though. Can you forward me a few of the emails you've received? 66rover99 at gmail dot com

Thanks, Dave

They have stopped :D thanks Dave.

PaulC wrote:They have stopped :D thanks Dave.

We'll get you back in this club one way or another!! :P

Dave

OK, folks, just an update of where things are at with this website...

1. All admin access passwords changed.

2. PHP updated (on new server)

3. MySQL updated (on new server)

4. Site including forums, photo gallery, ad serving, calendar and everything else moved over to the new server.

5. Wordpress tested as the new platform for the website, using nwchallenge.com as testbed. Most is working very well, a few things to tweak. Take a look and report back.

6. Wordpress installed for experimentation for the RoverLanders site as well.

Things to do:

1. Migrate advertisers from OpenAds to OpenX

2. Insert OpenX ad script in place of OpenAds ad script

3. Redesign site in Wordpress

4. Deploy new site.

We had to get some outside expertise for a lot of the technical stuff due to the hacking we went through. As a result I've been able to use the expertise to update us to much newer underlying technology, which should reduce the chances of another intrusion. However, the intruders are always finding a way in, so we'll have to keep the various technologies updated...

A big shout out to Dave B. For all the hard work he has gone through lately with the web site.

It's not as easy as it seems and i know i speak for many in thanking you "heaps" for all your work on this issue.

Hi Dave. I'm only able to access the web site from my iPhone only. When I use my laptop, I get the message "you don't have permission to access the requested object. It is either read protected or not readable by the server."
Any ideas?
Chris

Refresh your browser when you land on the front page, and delete cookies if that doesn't work.

Cheers, Dave