Web Site Infected

Hi there,
I'm the Admin of our Club (#8116) web site.

A few days ago our agenda page has been infected with spam ads when a member tries to add themselves to the agenda, and the site seems to launch ads/warning pages trying to get members to phone an "888" number to 'fix' the issue. These ads are launched when a member clicks the "Sign Up" box beside each role. There is a little green box with an arrow out of the top right corner that sits inside each "Sign Up" box. The "Sign Up" boxes are twice as large as they would be normally.

I've had a number of our members bring this issue up to me. It just happened to me as I tried to investigate member complaints. I shut down the offending pages by using the Task Administrator. The ensuing mayhem shut down Internet Explorer. The next time I logged in, the infection was gone and I could not replicate the infection. I was going to take some screen captures for documentation, but that is not now possible - maybe if it happens in the future. This happened to me at work, where we run 'industrial strength" virus scanners.

It only happens when members loggin, not the administrator.

Anyone else ran into this, and how do I deal with this infection? If it happens to me again - I'll try to provide screen captures.

Thanks,
Joe Kanera

Looks like some one put some ad javascripts in your agenda header. I have removed.

Thanks Brian. Not sure who would have done that, as I and one other person have access from our club, and we both try to keep things simple.

Again - thank you.
JoeK

Hi Brian,

It's happened again - Our agenda for June 8th is infected again with javascript. I tried to find the infection location to remove it, but cannot locate it. Can you have a look and let me know where it is I should be looking? And what to look for?

I had a long talk with our company IT head, and he's absolutely paranoid of these javascripts as they can download a payload and encrypt your hard drive and lock you out unless you pay a ransom. On a company network, that is a disaster.

I went through every page on the WEB ADMIN section and cannot locate any scripting. I'll change the ADMIN password tonight just in case, but only 2 other people have it and none are remotely connected to any computer operations. Our company IT head figures that maybe the main Toastmasters site got hacked where our site resides and could be propogating the script.

Any advice otherwise?

Thanks,
JoeK

Out of 10,800 sites on the server yours is the only one that has this issue.

Some one who has access is adding the script when they are editing the header.

How are you creating new agendas?

Are you using a template or are you using a previous meeting?