Intresting that i got no reactions from jcl

Sry i overread the post here.

Its still there btw!!! Randomly
This time it took me permission to post

Hopefully because he's busy

I believe it is not random, but scripted to resurrect after a timer expires.

Per my earlier posts, clearing cookies makes it not random. It works every time.

For me its randomly...no matter what i do.

http://www.opserver.de/ubb7/ubbthreads.php?ubb=showflat&Number=474513#Post474513

For info how to avoid redirection

Did you clear your cookies correctly? Try again. I get consistent behavior if and only if I clear my cookies all the time. (Hint: There is a sleep timer variable.)


....

To recap my independent investigation:

Repeatable behavior if you clear your cookies correctly:
http://www.opserver.de/ubb7/ubbthreads.php?ubb=showflat&Number=474505#Post474505

I managed to single out and block the two(2) malicious javascripts, thus ending the unwanted behavior on my personal browser only:
http://www.opserver.de/ubb7/ubbthreads.php?ubb=showflat&Number=474507#Post474507

Root cause found in (hacked?) ubb scripting, which launches the two(2) malicious javascripts:
http://www.opserver.de/ubb7/ubbthreads.php?ubb=showflat&Number=474547#Post474547

...


Finally, here's the culprit. Can an admin delete this one evil line of code? (See attachment for full scale.)

image.js on the zorro server:
http://www.opserver.de/ubb7/ubb_js/image.js

image.js on the UBB.threads server (the source):
https://www.ubbcentral.com/forums/ubb_js/image.js

I posted in mods and wrote a pm. Now i cant do more. Till now i got no answer...maybe admin is busy yes.

Edit
Just was redirected with edit button...damn that sucks...

edit2:
And directly after this...site was again overlayed with invisible link...



edit:
I used an old tab i had open to write here, i cant use page at all now. The link is always there now for me.

edit:
Ok i have control again...only "Deleting all temp Internet files and stuff" gave me control back. Wow!

Spot the differences.
http://www.opserver.de/ubb7/ubb_js/image.js
https://www.ubbcentral.com/forums/ubb_js/image.js

Does this code look friendly?
http://om.qqtx.me/jquery.jscroll.min.js

Let's make that last script readable:
https://pastebin.com/MqugfcZ7

Yes, I Think it is infected. I ve just been redirected to this page:
https://google-it.eventomensiledigadget....click=j6qqbg5m#

HtH

I have the infection feeling since the weekend.
Its fact that a invisible link layers the forum pages sometimes.

If u only look at the http site names...very long random names.
Also i realized blocked popups now, sometimes.

@all
Check the link your clicking on this page in Detail. Watch your Cursor when hovering over links. Or disable / block the script u can see in screenshots above.

Oh, looks like it's fixed now. Let's see if it stays that way...

The inserted "document.writeln" line found by AndrewAMD would indeed redirect clicks to a script on om.qqtx-me. But this line isn't in the forum source code. I also don't get that popup after deleting the cookies. So the source is apparently not infected, at least not now, but possibly the cache.

I will clear the cache now. Please report when you observe the popup again or something else that is unusual.