Whats with the LINKBUCKS crap!!!! rediculous, great way to end the site!!!

[SkippyKtm]

If a site is compromised, the only way to be real sure it is back up and clean is install from a known good backup. Fairly common in the hosting world, etc to have snapshots of the site, on another drive, just for this purpose. It has to come from before the compromise though and you will lose anything added from that point to present. but..you want to lose whatever malicious code got buried, so that's that.

For your own personal stuff, learn to use the browser security add-ons. Firefox is easy to use, but you should use several addons all the time in my opinion, then learn whitelisting and blacklisting. Noscript, adblock+, better privacy, ghostery are all good. Noscript and learning to use it is the most important. Also keep a couple live CDs (operating systems that run friom a CD or DVD disk only) hanging around if you think your hard drive got boned.


Even whopper big sites with full time ace IT guys get compromised, there is no permanent fix, no perfect solution as tech changes all the time. dotgov sites have gotten pwned, big commerce sites, all of them.

It is like saying, need the perfect machine that will never break, no matter how much it is used. Just ain't happening.

If an image is used to restore this site (and I do it all the time with my computers) it would be necessary, but kinda stink to lose all the data since this happened.
I know of a few AS members that are currently avoiding this site (because they're afraid it'll hose their computers...) until things get straightened out.:msp_wink:

 

[BiggerDiggler]

If an image is used to restore this site (and I do it all the time with my computers) it would be necessary, but kinda stink to lose all the data since this happened.
I know of a few AS members that are currently avoiding this site (because they're afraid it'll hose their computers...) until things get straightened out.:msp_wink:

I am now in the camp of avoiding this site, along with many others in this local area. Too bad.

 

[zogger]

If an image is used to restore this site (and I do it all the time with my computers) it would be necessary, but kinda stink to lose all the data since this happened.
I know of a few AS members that are currently avoiding this site (because they're afraid it'll hose their computers...) until things get straightened out.:msp_wink:

Yes, and it should have happened right then when the compromise was discovered, wipe/restore. Much less lost data then. Trying to winkle out some of the sophisticated malware out there can be a chore, and you never really know if you got it all either.

 

[zogger]

I am now in the camp of avoiding this site, along with many others in this local area. Too bad.

You don't have to if you follow the advice given up above on some basic browser security. Might take the equivalent in time as say..random TV football game.

I also don't run anything windows, but that's another subject and don't want to get into it here. This is chainsaw forum, not a nerd tech forum.

I wouldn't go to a nerd forum looking for chainsaw advice in other words. Info is out there on how to up your own personal security online. Nothing is perfect, but you can chip away at it and get down to pretty darn good.

It just takes doing, like the first time taking a carb apart...

Anyone who got hosed the first go around and experienced the malware redirect and the cookies, really needs to bone up on computer security, because I 100% guarantee you, it just is not this site, and you get get nailed with a driveby and *not even know it*. That's how these guys get MILLIONS of "zombie" computers they control, most of them running some flavor of windows.

I'd easily bet a years pay right now there are numerous windows users who have come to this site regularly and are running compromised machines -"zombies"- and they don't know it.

Not all compromises are meant to be seen.....

 

[Wood Doctor]

Not a perfect fix but...

I need javascript for many of my other web stuff so this is what I did in Google Chrome. Go to the upper right hand corner to that icon with three horizontal bars. Click it. Go to "Settings". Click on "advanced settings". In "Privacy" click on "content settings". In the JavaScript section click on "manage exceptions". In that area enter " [*.]arboristsite.com " and choose "block" in the drop down menu to the right of it. This blocks JavaScript on Arboristsite only and that will block the Linkbucks B.S.

That almost worked for me, but the text box for entering the exception was a dead hammer and allowed no keyboard input. My only recourse was to block all Javascript. That seems to work except now all my icons to accompany the text in the post are also dead, such as my head beating against the wall. If you block all Javascript, you will lose a ton of search images and Lord knows what else at other sites.

This is one heckuva bug.

 

[RedneckChainsawRepair]

I just got this and a blank page a second ago. The file /home/arborist/public_html/includes/ibid_functions.php is corrupted.

 

[Big_Wood]

I have broke down and started running tapatalk. The iphone is a piece trying to access AS without it. I care more about my computer then my phone so that how it goes for now. It seems the PC works between 4-8pm. All other hours i get that annoying link bucks crap. Thats what i've found anyways. I've tried the browser security methods with no luck. I even went as far as getting blocking extensions to stop it but no go. No matter what i disable or enable it still goes to link bucks but doesn't run any of the plug ins. I figured when i saw nmurphs way it would work for me but it didn't. Must be some other setting on my computer stopping it. It is quite frustrating but i won't give up on AS. I tried other similar forums but can't find anything that compares.


Sent from my iPhone using Tapatalk - now Free

 

[RickDoll]

I am nobody here so take anything I say with a grain of salt, I am only here curious because a friend of mine is a member here.

The link they were using for the JS the other day is no longer the one they are using, you will now need to search for the link: http://www.linkbucks.com/visitScript/d31da00d and remove the script tag for it.

If I had to guess i would say someone got a hold of the ftp account password. I would change the password(s) pronto.

Also a possibility that one of the "trusted" admins/mods here isn't as trustworthy as one has thought as i am fairly sure you can edit most of the pages in the admin section of vbulletin.

I have seen some mention that they think LinkBucks is doing the hacking, I kind of doubt it as when you view the actual JS code they are using there is a member ID which I would assume is a member over at LinkBucks. member ID: 679232.

Hope it helps...

 

[Timster2]

I loaded and am running NoScript seems to be working well and as a side benefit it has stopped a lot of other sites from loading annoying adds constantly.

 

[w8ye]

Don't forget "Add Block Plus" (ABP) while you are at it?

 

[Rookie1]

Im having issues with linkbucks redirecting me too. Just had to click skip this add 4 times to post this reply. So aggravating that Im done here til it gets resolved. :msp_sad:

 

[w8ye]

Linkbucks has 15-20 alias names in Javascript that all take you to Linkbucks. So far, we've only seen one alias besides the main one.

 

[ndlawrence]

We need to get this fixed, instead of finding ways to work around these scum bags.

 

[dancan]

So far Chrome or Iron from SRWare with ScriptSafe has worked great .

 

[jwilly]

I copied the url of Linkbucks into my security as a blocked site

 

[Wood Doctor]

Asking Chrome to block Javascript for all sites solves nothing. Yes, it helps run this site but it cripples many other search features that make using the Internet friendly.

This is a huge bug that may take weeks for ArboristSite to fix because we have been targeted. Dozens of other sites are also suffering because of this.

 

[Pelorus]

I am nobody here so take anything I say with a grain of salt, I am only here curious because a friend of mine is a member here.

The link they were using for the JS the other day is no longer the one they are using, you will now need to search for the link: http://www.linkbucks.com/visitScript/d31da00d and remove the script tag for it.

If I had to guess i would say someone got a hold of the ftp account password. I would change the password(s) pronto.

Also a possibility that one of the "trusted" admins/mods here isn't as trustworthy as one has thought as i am fairly sure you can edit most of the pages in the admin section of vbulletin.

I have seen some mention that they think LinkBucks is doing the hacking, I kind of doubt it as when you view the actual JS code they are using there is a member ID which I would assume is a member over at LinkBucks. member ID: 679232.

Hope it helps...

Some of you computer savvy guys (incl. Zogger) are making me nervous.......but in a good sorta way.

 

[w8ye]

It is a lot quicker and easier for us as individuals to block Linkbucks and all its aliases and not worry about the problem any more.

Like has been said, it may take a week or two to find the little code line that automatically injects the linkbucks deal into Javascript on AS.

With interfaces like Firefox and add-ons like Noscript, all you have to do is OK Arboristsite. If you do not OK linkbucks or the other icons related to Linkbucks, then you never bother with it.

I've been involved with this before at another site and it took some three weeks to find the short embedded line of code.

 

[fearofpavement]

I use Firefox. Went to addons, did a search for noscript, downloaded that, restarted my computer. No more linkbucks. At least as of now.

 

[Mac 6-10]

I use Firefox. Went to addons, did a search for noscript, downloaded that, restarted my computer. No more linkbucks. At least as of now.

I use firefox aswell. just installed noscript and so far so good. i just navigated from home to chainsaw stickies to chainsaw to my settings and back to chainsaw in 2 minutes! boy the things you take for granted!