TOPIC:

Hi there,
I'm the Admin of our Club (#8116) web site.

A few days ago our agenda page has been infected with spam ads when a member tries to add themselves to the agenda, and the site seems to launch ads/warning pages trying to get members to phone an "888" number to 'fix' the issue. These ads are launched when a member clicks the "Sign Up" box beside each role. There is a little green box with an arrow out of the top right corner that sits inside each "Sign Up" box. The "Sign Up" boxes are twice as large as they would be normally.

I've had a number of our members bring this issue up to me. It just happened to me as I tried to investigate member complaints. I shut down the offending pages by using the Task Administrator. The ensuing mayhem shut down Internet Explorer. The next time I logged in, the infection was gone and I could not replicate the infection. I was going to take some screen captures for documentation, but that is not now possible - maybe if it happens in the future. This happened to me at work, where we run 'industrial strength" virus scanners.

It only happens when members loggin, not the administrator.

Anyone else ran into this, and how do I deal with this infection? If it happens to me again - I'll try to provide screen captures.

Thanks,
Joe Kanera

Looks like some one put some ad javascripts in your agenda header. I have removed.

Thanks Brian. Not sure who would have done that, as I and one other person have access from our club, and we both try to keep things simple.

Again - thank you.
JoeK

Hi Brian,

It's happened again - Our agenda for June 8th is infected again with javascript. I tried to find the infection location to remove it, but cannot locate it. Can you have a look and let me know where it is I should be looking? And what to look for?

I had a long talk with our company IT head, and he's absolutely paranoid of these javascripts as they can download a payload and encrypt your hard drive and lock you out unless you pay a ransom. On a company network, that is a disaster.

I went through every page on the WEB ADMIN section and cannot locate any scripting. I'll change the ADMIN password tonight just in case, but only 2 other people have it and none are remotely connected to any computer operations. Our company IT head figures that maybe the main Toastmasters site got hacked where our site resides and could be propogating the script.

Any advice otherwise?

Thanks,
JoeK

Out of 10,800 sites on the server yours is the only one that has this issue.

Some one who has access is adding the script when they are editing the header.

How are you creating new agendas?

Are you using a template or are you using a previous meeting?

Is it just your computer or everyone else's for your club?

If you access your agendas from your home computers, do you still see the issue?

Hi Steve & Brian:

Brian - The Agendas have been created by copying an older agenda & then modifying it.

Steve - Almost everybody has the issue. I experienced it at my work computer & at my home computer.

I've now changed the password so now I am the only one with access. Would it be a solution to delete all the future agendas & re-create them from a clean template? I've looked into the agenda header of the affected agenda but I do not see any sign of a script.

Thanks,
JoeK

Steve & Brian,

I've checked all the headers in HTML in the agendas, and there does not seem to be a script there. I guess that one of you must have removed it. It took me a bit to see the "source" button to access the HTML. Now I know where to look.

Thanks,
JoeK

The only places scripts could reside in agendas are the past agendas and the default header in the Agenda Settings module.

One key difference between the dated agendas and named templates is that the headers are saved w/ the dated agendas, but templates do not really have headers saved with them. The default header in Agenda Settings is independent of any one named template. If you typically create new agendas from past ones, then you should look at the headers of those past agendas. If you typically create from named templates, then you only need to look at the default header.