Malvetising - TitanPoker Popup Ads on our site

[Movie Prop Sites]

Since approximately Jan 20th, we have had a number of our members getting popups for "TitanPoker.com" on our site.

In researching this issue, we aren't able to replicate this problem ourselves, but see that a numbe of other IPB based sites are having the same problem.

Have any of you had this issue, and if so, how did you resolve it?

[Part]

I also have the same problem.

[Ohio Riders]

Others:

http://hoops-nation.com/community/topic/64148-this-titan-poker-popup/

http://wetpixel.com/forums/index.php?showtopic=49133

http://translate.google.com/translate?hl=en&sl=ro&tl=en&u=http%3A%2F%2Fforum.seopedia.ro%2Fspam-made-ro%2F25241-pop-up-spam-titan-poker.html

On Wordpress also:

http://wordpress.org/support/topic/a-very-very-strange-problem

[ModSquadHockey]

Some of my guys are reporting the same thing.

Don't know where to start.

[jackflash]

one of ours sites now has this to...

[RogEnk]

Any strange php files in your install?

http://community.invisionpower.com/topic/380700-found-unusual-php-files-in-forum-root/

Worth having a look at this:

http://www.invisionpower.com/support/kb/_/how-to-clean-your-site-from-infection-r27

[Dmacleo]

disable any adsense ads (or any ad block really) first of all and see if it stops

[jackflash]

We don't use adsense. I'll have to see if something on the main server side is infected.

[Dmacleo]

this titan one was known to be introduced through google ads on some sites before, wasn't so much the actual site itself that was the issue but the ad server itself in some cases.

[Part]

I'm still having the same problem - anyone fixed this? And I use no ads what so ever on the site, but people keep reporting this (not AdSense, nor any other ads for that matter..)

[grinler]

If you want to pm me your site, I can see if I can try down the culprit for you.

[Mark H]

Try this.

Go to ACP -> Look & Feel.

On that page go to Template Tools, top right, re-cache each skin individually, and make sure it reports that all cache files were written.

Then on that page, go to Manage Languages, and click the green double-circle to the right of each language pack refresh the lang cache.

Then see if the problem still happens. Every time we've seen this come up, it was a hack of a lang or skin cache file that wasn't cleaned out after the site was compromised.

If all else fails, please file a ticket. :smile:

[Mat-Moo]

Same issue on my site, will recache and see what happens