[clm]

i keep getting a pop up but omnly when i visit this site.  it is a box entitled MS internet explorer saying do you want to download free soft ware and giving me the option of yes and nothing else. seems to be associated with a download box for some movie software.  only happens with this site and freezes up the windows until i click yes.  is it this site or is it my computer?

[Carnage]

I'm getting it too and its fucking annoying. :evil:

[chappers]

im getting the same thing, only on the front page. but over and over bout 10 times.
getting on my tits

[Jim]

I get this as well, its annoying

[Bubba]

Looking into it now people...

[Bonjoy]

Am getting it too

[Bubba]

As far as I can see, it only happens in Internet Explorer - is anyone getting it using Firefox?

[dave]

I get it too. I changed some of the activeX settings on my tinternet explorer security and its OK now. We all know IE blows, but some of us are stuck with it at work.

[Bubba]

I've found the problem - somehow, some code had been inserted into the forum configuration database which caused the software to pull in some .php code from a malicious site.

I have removed the offending code from the database (It was nothing too serious but was annoying adware)

Unfortunately, if you have already been infected, it's probably dropped some files onto your PC.

* I have done the following and the problem has gone away *

i) Exit IE

ii) Empty your temporary internet files (in C:\windows\documents and settings\*your user name*\local settings\
- There is a particular file, starting with name "ireg32" that will be infected.

iii) To be certain, run a full virus scan using a good, up to date virus scanner like Norton Antivirus (it should pick up a virus in a file with a name starting with 2ireg32" - NB it may not be able to automatically fix this problem.

iv) Stop using Internet Explorer !
- I know I've said this many times, but running IE on your computer is a huge security risk - use Firefox instead. As Dave says, I know lots of you have to use it at work, but don't use it at home.

btw Dave, what Active X settings did you change?

If you require more information, which may be pertinent to your setup (most of it didn't apply to mine), please look at this page.

[Bonjoy]

Didn't get it this time I entered site.

[cofe]

i don't get it. la la la.

but i am using bad/angry firefox...

[Bubba]

Cool, I think it's sorted now, but also make sure to check your PC for the infected file.

Thanks for bringing this up though CLM, I would never have noticed it otherwise.

[dave]

can't remember exactly what i changed, but went into the custom settings on the internet security zone and switched summert from "disable" to "prompt" (everything else was already set to enable or prompt as part of the default meduim security setting), the thinking being i could get to choose what was going on and shit.

[Jim]

Its gone. WooHoo

[dave]

anyone else getting redirected to http://www.cashtoolbar.net/reg.php?ref=2351 a few seconds after ukb loads?

[JR]

yes, its f*ing annoying

[jimbo]

Yep, just started happening since i got back from lunch.

[dave]

i think someone is twisting our shit.

[cofe]

me too.

[JR]

its now telling me there are no posts in the bouldering forum!!?!?!

[Bubba]

The no posts thing is an intermittent problem and nothing to do with the cashtoolbar.net one.

Ok, I've just re-tested in IE and checked the database and all is well.

Have you gone through all the steps I outlined in my earlier post? If you haven't, then it's going to keep happening because it places infected files on your PC. I've sorted the server end, but you've got to clean your own PC at your end.

[JR]

The no posts thing is an intermittent problem and nothing to do with the cashtoolbar.net one.

Ok, I've just re-tested in IE and checked the database and all is well.

Have you gone through all the steps I outlined in my earlier post? If you haven't, then it's going to keep happening because it places infected files on your PC. I've sorted the server end, but you've got to clean your own PC at your end.

Yes, I only use firefox anyway.

I checked anyway and i had no spyware or viruses.

[Bubba]

Which page is affected? I'm using firefox and the main forum and the portal page aren't having problems.

[JR]

http://www.ukbouldering.com/board/

It would reload after a few seconds to cashtoolbar.cunts

Although curiously its not doing it anymore ie last 15 mins

[cofe]

curiously

i saw this word and immediately twirled my 'tache.

the plot thickens...