Hello!
Since yesterday, whenever I try to login on my forums (when I click on the username field) I get a popup ad, which I did not insert myself. It happens not only to me, but to members as well.
What's strange is that it appears even when I login in the admin panel, or when I try to edit the username of a member in the admin panel. It also appears when you click in the search field.
I mention I didn't add any new plugin, also I tried disabling all hooks globally and it's still the same. I also removed all banner ads and it was still the same. I looked to see if there are new admin accounts, but it is just mine.
Other than that, when clicking on the forum pages, no popup appears, just when you click in fields it does.
I also checked the page source but I could find no weird ad code.
Here is the page source of the admin login page (it showed 1 popup when I tried to login):
Could the malicious code be inserted in some file that deals with fields? I don't know where to search for it.
EDIT: I noticed that vbulletin-core.js was modified exactly in the day since when the issue appeared. I uploaded an old version of it (since 2015, when the issue wasn't occurring) but the issue is still the same. However, now, at times, the popup appears if the click is made anywhere on the page, not just in the username or search field.
Since yesterday, whenever I try to login on my forums (when I click on the username field) I get a popup ad, which I did not insert myself. It happens not only to me, but to members as well.
What's strange is that it appears even when I login in the admin panel, or when I try to edit the username of a member in the admin panel. It also appears when you click in the search field.
I mention I didn't add any new plugin, also I tried disabling all hooks globally and it's still the same. I also removed all banner ads and it was still the same. I looked to see if there are new admin accounts, but it is just mine.
Other than that, when clicking on the forum pages, no popup appears, just when you click in fields it does.
I also checked the page source but I could find no weird ad code.
Here is the page source of the admin login page (it showed 1 popup when I tried to login):
Code:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> [TABLE] [TR] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en">[/TD] [/TR] [TR] [TD] [/TD] [TD]<head>[/TD] [/TR] [TR] [TD] [/TD] [TD]<title>Log in - Forums - vBulletin Admin Control Panel</title>[/TD] [/TR] [TR] [TD] [/TD] [TD]<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<link rel="stylesheet" type="text/css" href="../cpstyles/global.css?v=422"/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<link rel="stylesheet" type="text/css" href="../cpstyles/vBulletin_3_Silver/controlpanel.css?v=422"/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<style type="text/css">.page{background-color:white;color:black;}.time{color:silver;}.feature_management_header{font-size:16px;}#category_title_controls{padding-left:10px;font-weight:bold;font-size:14px;}.picker_overlay{background-color:white;color:black;font-size:14px;padding:3px;border:1px solid black;}.selected_marker{margin-right:4px;margin-top:4px;float:left;}.section_name{font-size:14px;font-weight:bold;padding:0.2em 1em;margin:0.5em 0.2em;background-color:white;}.tcat .picker_overlay a,.picker_overlay a,a.section_switch_link{color:blue;}.tcat .picker_overlay a:hover,.picker_overlay a:hover,a.section_switch_link:hover{color:red;}</style>[/TD] [/TR] [TR] [TD] [/TD] [TD]<script type="text/javascript">[/TD] [/TR] [TR] [TD] [/TD] [TD]<!--[/TD] [/TR] [TR] [TD] [/TD] [TD]var SESSIONHASH = "";[/TD] [/TR] [TR] [TD] [/TD] [TD]var ADMINHASH = "045bc1e9e281872e8bfad849f39d19c5";[/TD] [/TR] [TR] [TD] [/TD] [TD]var SECURITYTOKEN = "1491851501-375837caf47090c879bd5c64a4f1517ea8de8ab7";[/TD] [/TR] [TR] [TD] [/TD] [TD]var IMGDIR_MISC = "../cpstyles/vBulletin_3_Silver";[/TD] [/TR] [TR] [TD] [/TD] [TD]var CLEARGIFURL = "./clear.gif";[/TD] [/TR] [TR] [TD] [/TD] [TD]var AJAXBASEURL = "http://www.mysite.com/forums/acesadm/../";[/TD] [/TR] [TR] [TD] [/TD] [TD]var BBURL = "http://www.mysite.com/forums";[/TD] [/TR] [TR] [TD] [/TD] [TD]var PATHS = {[/TD] [/TR] [TR] [TD] [/TD] [TD]forum : "",[/TD] [/TR] [TR] [TD] [/TD] [TD]cms : "",[/TD] [/TR] [TR] [TD] [/TD] [TD]blog : ""[/TD] [/TR] [TR] [TD] [/TD] [TD]};[/TD] [/TR] [TR] [TD] [/TD] [TD]function set_cp_title()[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]if (typeof(parent.document) != 'undefined' && typeof(parent.document) != 'unknown' && typeof(parent.document.title) == 'string')[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]parent.document.title = (document.title != '' ? document.title : 'vBulletin');[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]//-->[/TD] [/TR] [TR] [TD] [/TD] [TD]</script>[/TD] [/TR] [TR] [TD] [/TD] [TD]<script type="text/javascript" src="../clientscript/yui/yuiloader-dom-event/yuiloader-dom-event.js"></script>[/TD] [/TR] [TR] [TD] [/TD] [TD]<script type="text/javascript" src="../clientscript/yui/connection/connection-min.js"></script>[/TD] [/TR] [TR] [TD] [/TD] [TD]<script type="text/javascript" src="../clientscript/vbulletin-core.js"></script>[/TD] [/TR] [TR] [TD] [/TD] [TD]<script type="text/javascript" src="../clientscript/vbulletin_ajax_suggest.js"></script>[/TD] [/TR] [TR] [TD] [/TD] [TD]</head>[/TD] [/TR] [TR] [TD] [/TD] [TD]<body style="margin:0px" onload="set_cp_title(); document.forms.loginform.vb_login_password.focus()">[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]<script type="text/javascript" src="../clientscript/vbulletin_md5.js?v=422"></script>[/TD] [/TR] [TR] [TD] [/TD] [TD]<script type="text/javascript">[/TD] [/TR] [TR] [TD] [/TD] [TD]<!--[/TD] [/TR] [TR] [TD] [/TD] [TD]function js_show_options(objectid, clickedelm)[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]fetch_object(objectid).style.display = "";[/TD] [/TR] [TR] [TD] [/TD] [TD]clickedelm.disabled = true;[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]function js_fetch_url_append(origbit,addbit)[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]if (origbit.search(/\?/) != -1)[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]return origbit + '&' + addbit;[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]else[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]return origbit + '?' + addbit;[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]function js_do_options(formobj)[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]if (typeof(formobj.nojs) != "undefined" && formobj.nojs.checked == true)[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]formobj.url.value = js_fetch_url_append(formobj.url.value, 'nojs=1');[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]return true;[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]//-->[/TD] [/TR] [TR] [TD] [/TD] [TD]</script>[/TD] [/TR] [TR] [TD] [/TD] [TD]<form action="../login.php?do=login" method="post" name="loginform" onsubmit="md5hash(vb_login_password, vb_login_md5password, vb_login_md5password_utf); js_do_options(this)">[/TD] [/TR] [TR] [TD] [/TD] [TD]<input type="hidden" name="url" value="/forums/acesadm/index.php"/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<input type="hidden" name="s" value="6583ed39a35588cc17041d37a590a7de"/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<input type="hidden" name="securitytoken" value="1491851501-375837caf47090c879bd5c64a4f1517ea8de8ab7"/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<input type="hidden" name="logintype" value="cplogin"/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<input type="hidden" name="do" value="login"/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<input type="hidden" name="vb_login_md5password" value=""/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<input type="hidden" name="vb_login_md5password_utf" value=""/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<p> </p><p> </p>[/TD] [/TR] [TR] [TD] [/TD] [TD]<table class="tborder" cellpadding="0" cellspacing="0" border="0" width="450" align="center"><tr><td>[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]<div class="tcat" style="padding:4px; text-align:center"><b>Log in</b></div>[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]<table cellpadding="4" cellspacing="0" border="0" width="100%" class="navbody">[/TD] [/TR] [TR] [TD] [/TD] [TD]<tr valign="bottom">[/TD] [/TR] [TR] [TD] [/TD] [TD]<td><img src="../cpstyles/vBulletin_3_Silver/cp_logo.gif" alt="" title="Powered by vBulletin® Version 4.2.2 Copyright © 2017 vBulletin Solutions, Inc. All rights reserved." border="0"/></td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<b><a href="http://www.mysite.com/forums/forum.php"> Forum</a></b><br/>[/TD] [/TR] [TR] [TD] [/TD] [TD]vBulletin 4.2.2 Admin Control Panel<br/>[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]</td>[/TD] [/TR] [TR] [TD] [/TD] [TD]</tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]</table>[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]<table cellpadding="4" cellspacing="0" border="0" width="100%" class="logincontrols">[/TD] [/TR] [TR] [TD] [/TD] [TD]<col width="50%" style="text-align:right; white-space:nowrap"></col>[/TD] [/TR] [TR] [TD] [/TD] [TD]<col></col>[/TD] [/TR] [TR] [TD] [/TD] [TD]<col width="50%"></col>[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]<tbody>[/TD] [/TR] [TR] [TD] [/TD] [TD]<tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td>User Name</td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td><input type="text" style="padding-left:5px; font-weight:bold; width:250px" name="vb_login_username" value="Key" accesskey="u" tabindex="1" id="vb_login_username"/></td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td> </td>[/TD] [/TR] [TR] [TD] [/TD] [TD]</tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]<tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td>Password</td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td><input type="password" style="padding-left:5px; font-weight:bold; width:250px" name="vb_login_password" accesskey="p" tabindex="2" id="vb_login_password"/></td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td> </td>[/TD] [/TR] [TR] [TD] [/TD] [TD]</tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]<tr style="display: none" id="cap_lock_alert">[/TD] [/TR] [TR] [TD] [/TD] [TD]<td> </td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td class="tborder"><strong>Caps Lock is on!</strong><br/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<br/>[/TD] [/TR] [TR] [TD] [/TD] [TD]Having Caps Lock on may cause you to enter your password incorrectly. You should press Caps Lock to turn it off before entering your password.</td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td> </td>[/TD] [/TR] [TR] [TD] [/TD] [TD]</tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]</tbody>[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]<tbody id="loginoptions" style="display:none">[/TD] [/TR] [TR] [TD] [/TD] [TD]<tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td>Style</td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td><select name="cssprefs" class="login" style="padding-left:5px; font-weight:normal; width:250px" tabindex="5"> <option value="vBulletin_2_Default">vBulletin 2 Default</option>[/TD] [/TR] [TR] [TD] [/TD] [TD]<option value="vBulletin_3_Default">vBulletin 3 Default</option>[/TD] [/TR] [TR] [TD] [/TD] [TD]<option value="vBulletin_3_Frontend">vBulletin 3 Frontend</option>[/TD] [/TR] [TR] [TD] [/TD] [TD]<option value="vBulletin_3_Manual">vBulletin 3 Manual</option>[/TD] [/TR] [TR] [TD] [/TD] [TD]<option value="" selected="selected">vBulletin 3 Silver</option>[/TD] [/TR] [TR] [TD] [/TD] [TD]</select></td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td> </td>[/TD] [/TR] [TR] [TD] [/TD] [TD]</tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]<tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td>Options</td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<label><input type="checkbox" name="nojs" value="1" tabindex="6"/> Save open navigation groups automatically</label>[/TD] [/TR] [TR] [TD] [/TD] [TD]</td>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td class="login"> </td>[/TD] [/TR] [TR] [TD] [/TD] [TD]</tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]</tbody>[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]<tbody>[/TD] [/TR] [TR] [TD] [/TD] [TD]<tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]<td colspan="3" align="center">[/TD] [/TR] [TR] [TD] [/TD] [TD]<input type="submit" class="button" value=" Log in " accesskey="s" tabindex="3"/>[/TD] [/TR] [TR] [TD] [/TD] [TD]<input type="button" class="button" value=" Options " accesskey="o" onclick="js_show_options('loginoptions', this)" tabindex="4"/> </td>[/TD] [/TR] [TR] [TD] [/TD] [TD]</tr>[/TD] [/TR] [TR] [TD] [/TD] [TD]</tbody>[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]</table>[/TD] [/TR] [TR] [TD] [/TD] [TD]</td></tr></table>[/TD] [/TR] [TR] [TD] [/TD] [TD]</form>[/TD] [/TR] [TR] [TD] [/TD] [TD]<script type="text/javascript">[/TD] [/TR] [TR] [TD] [/TD] [TD]<!--[/TD] [/TR] [TR] [TD] [/TD] [TD]function caps_check(e)[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]var detected_on = detect_caps_lock(e);[/TD] [/TR] [TR] [TD] [/TD] [TD]var alert_box = fetch_object('cap_lock_alert');[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]if (alert_box.style.display == '')[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]// box showing already, hide if caps lock turns off[/TD] [/TR] [TR] [TD] [/TD] [TD]if (!detected_on)[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]alert_box.style.display = 'none';[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]else[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]if (detected_on)[/TD] [/TR] [TR] [TD] [/TD] [TD]{[/TD] [/TR] [TR] [TD] [/TD] [TD]alert_box.style.display = '';[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]}[/TD] [/TR] [TR] [TD] [/TD] [TD]fetch_object('vb_login_password').onkeypress = caps_check;[/TD] [/TR] [TR] [TD] [/TD] [TD]//-->[/TD] [/TR] [TR] [TD] [/TD] [TD]</script>[/TD] [/TR] [TR] [TD] [/TD] [TD] [/TD] [/TR] [TR] [TD] [/TD] [TD]</body>[/TD] [/TR] [TR] [TD] [/TD] [TD]</html>[/TD] [/TR] [/TABLE]
Could the malicious code be inserted in some file that deals with fields? I don't know where to search for it.
EDIT: I noticed that vbulletin-core.js was modified exactly in the day since when the issue appeared. I uploaded an old version of it (since 2015, when the issue wasn't occurring) but the issue is still the same. However, now, at times, the popup appears if the click is made anywhere on the page, not just in the username or search field.
Comment