Hello

I keep getting this virus on my xoops. It makes a yellow bar appear on my screen everytime I go to my XOOPS site.
How do I take this thing out please??? My back ups are already infected with this.
Thanks
EwaeyUsa.
http://community.ewaey.com

have you checked from another pc??? beacause i dont see anything wrong in your site... maybe your PC... is infected... and not hacked your site.

Are you using IE7? (Could it be your browser showing that).

What does the bar say? I too don't see it on your site.

I notice there's a dodgy-looking Iframe at the bottom of your theme.html if you view the source...

Quote:

It does appear to be a virus. Or at least, I visited the page and when I closed the (crappy IE6) browser window I got a virus alert from AVG.

Can't help fix it, sorry. Total newbie here.

Sounds suspiciously like a spyware browser hijack.

I would recommend getting a decent virus killer - and perhaps looking at a spyware finder / killer... I use Spybot S&D myself - but other people may have their own ideas.

I'll have to make a couple of assumptions here -

1. I assume you are using templates. When you generated the templates, did you do some from an IE browser? If so, does that browser have a bunch of tools hooked to it - like goole search, etc?

2. Did you design the theme for your site? Look at this validation for your site. You will see a number of errors that should be corrected.

3. I noticed, and have seen this before, look at line 156 - outside of your block - there is a hidden iFrame pointing to an IP address. Unless you actually have that in your theme - where is that going?

According to IP lookup - the IP belongs to the RIPE network - which I like to blacklist on a regular basis...anyway, the that it points your users to is probably the culprit.

So, what to do...first, make sure your IE or Firefox is clean. Next, delete your templates and regenerate. If the problem persists, you need to do some deep scanning of your personal system.

Hope this evaluation helps!

Yeah, that's shady. The iframe loads another iframe which is here: 81.95.145.240/go.php?sid=1. I don't know what's that, it comes back empty when I try to fetch it. It's not in your theme.html, and it also doesn't seem to be coming with your modules. So, you may want to empty all your cache and templates_c folder (drop an empty index.html into them once they're empty, just in case), and also make sure your index.php in the root directory hasn't been altered.

*edit: New info*

Yes, it's definitely the iframe, and it's definitely nasty stuff being triggered there. Read here:

http://isc.sans.org/diary.html?storyid=2923
I find it probable that someone has hacked your index.php at your XOOPS root. You should try to get your webhost to grep your entire directory structure for the string "iframe" and see whether all of them are accountable for. Or perhaps the malicious IP will do for a search string. Perhaps you have shell access and can do it yourself.

Furthermore, I think it's likely that someone has hacked your server, and not your XOOPS installation. You may want to alert the server admin.