MODx Forum Infected With Malware

After visiting the forum this morning my computer was infected with Malware.

I wasn’t on any other site, so I can be certain that the MODx forum is/was responsible for the problem.

(For info: I clear cookies, cache etc. manualy after using the internet or using the browser on a local basis)

As I could no-longer use my desktop computer, with the help of my old laptop I was able to find out what the problem was:

Look at this post and you will see that this problem is not new.

The malware that was installed on my computer can be read about here: "2-spyware.com/remove-winpc-defender.html"

Forum Team, please research this.

The pages I looked at this morning were (http:// removed just in case):

modxcms.com/forums/index.php/topic,61701.0.html
modxcms.com/forums/index.php/topic,58733.0.html

There were a couple of other pages but I don’t know the URI’s anymore.

UPDATE:

Have been able to get the desktop computer back up and running using the information that can be found on the 2-spyware.com site and by doing a system restore (which lost 8 hours work that I completed yesterday )

As your link shows it’s got to do with SMF and seems to pop up at random times. Counting down until we can migrate over to Discuss.....

I do hope you have some live protection that fetches malware the moment it pops up? Malware & virusses are everywhere so if you don’t, you’re not just risking losing work (or worse) on this forum..

Anti-virus and Anti-Malware programs don’t always catch everything - yes, my computer is protected, but that one got through.

This isn’t the first time that I have had problems with malware, trojans or a virus from the Forum, the other times my computer has caught the problems before they could do any damage, that was the reason why I still used the forum.

Now, after your answer (@ Mark H.) - I think I will stay away until the Forum has been ported to the new system.

I’ve been on these forums for 2-3 years and was never hit by malware. Think about it. 30K+ users, and not even a dozen reports in all those years.

While I can’t wait for the migration either I think you’re overreacting in staying away from the forum until then. You may have interpreted the last line of my prior post differently than I intended - the world wide web is full with infected web pages, so if your protection hasn’t been dealt with properly you are risking the same happening outside of the forum as well. Nothing is safe from that when you look at what some people are doing with Government run sites..

@Mark H

If you are talking time of use - I’ve been using the MODx CMS and the forum since it started out

Although its not the same, my websites have been hacked multiple times because of using MODx, but I still use it, because it is out of its teething stage and now one of the best and secure CMS’s out there (IMHO).

When it comes to having your work computer infected and not being able to control whats going on, then I think thats not over-reacting.

I am on my old laptop, which I have set-up for using the MODx forum, I dont care if it gets infected, there’s nothing significant on it.

Reference your last comment: Im not new to the net, i’ve been developing websites for over 10 years and know what criminals do on the net.

In my opinion it doesn’t matter if one person or 10,000 people report problems with malware, virus’s etc. MODx has become a well known name and with that, a large responsibility has grown towards the users of both the site and the MODx CMS system.

This post was not meant to create a huge discussion, it was there to alert the MODx Forum team that this problem is still at large and that Forum user’s might be at risk.

I had the same problem today.

This morning I tried to visit the forum in Firefox and this is what happened: immediately after loading the first page, a piece of malware which presents itself as "Malware Protection" installed itself, killed the browser and all other programs that were open. It then tries to force you to activate their "protection" (for this you have to pay of course) and makes it impossible to start any other executables. (All this happened immediately after visiting the forum and I had already visited other pages that morning with no problems.)

I got rid of it by (DO THIS AT YOUR OWN RISK):
- starting up in safe mode
- removing C:\Users\[myusername]\AppData\Roaming\defender.exe
- removing a registry key which I have forgotten the name of now but you find it when you search the registry for "malware protection".

I then restarted in regular mode, tried to visit the forum in Firefox again and immediately had the same problem. The reason I managed to type this message is that I am now using Google Chrome and there the problem does not occur.

I am on Windows 7 with AVG anti-virus for which we have a valid license. AVG is updated daily but it did not do anything to stop this.

Not sure what to make of all this. I just thought it might be useful to report.

Happened to me again yesterday (using FireFox and all "Anti-" programs up to date), didn’t re-post about it as there seems to be no major need to combat this problem from the MODx forum side (responsible developers / admins) at the moment.

I think we will have to live with it, it’s a shame, but I suppose that’s life.

Hmm it’s popping up more often now?

Can you guys post on what page it popped up?

I visited http://modxcms.com/forums/ and possibly also http://modxcms.com/forums/index.php/board,317.0.html. I am quite sure I did not get further than that.

Folks are you doing any searches via google, bing or etc. to locate site?

What OS/Browsers
What Region are you coming from.

The reason I ask is that many of these malware/virus/hacks use particular triggers to avoid detection but when coming to the site using a particular IP etc or via search it is triggered.

More details the better.

Indeed, getting onto Discuss will be win.