Strange mobile problem, possible malware

Discussion regarding Joomla! 3.x security issues.

Moderators: Bernard T, mandville, fcoulter, PhilD, General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.
Anubisoprema
Joomla! Apprentice
Joomla! Apprentice
Posts: 9
Joined: Wed Sep 04, 2013 11:11 pm

Strange mobile problem, possible malware

Postby Anubisoprema » Thu Jun 29, 2017 3:59 pm

Hi,

Till 2 days ago, everything was great with my Joomla site (web shop), but now I have strange problem. Don't know if it is hack, malware, or something else, but here is what is so strange:

When I am looking and browsing on desktop site (on my laptop or desktop computer), everything is OK and no problem, also, when I am looking trough site with my mobile phone or small tablet everything is still OK, but when I press "back button" in browser, it doesn't take me back on my mobile web site, but starts jumping trough several web addresses and then ends on some address that is some kind advertise or "download this" - "download that" stuff.

Everything is OK on mobile when I am going in advance trough menu, trough shop item and putting it to cart, but every time I press back, it doesn't matter where I am on web site, or from which device is browsing (iOS or Android), first time I press "back" it goes to some advertise site.

There is no problem on my mobile device if I put my web shop/site to "browse as desktop version". When is desktop verison, also on my mobile device I can go back and advance trough site, but as soon as I put it do "mobile version" (responsive), back button is just "hacked".

Any similar problems like mine? :(

I must say that I have Virtuemart on my site and Gavick theme ... :'(

User avatar
websitedons
I've been banned!
Posts: 389
Joined: Sat May 27, 2017 9:42 am

Re: Strange mobile problem, possible malware

Postby websitedons » Thu Jun 29, 2017 4:22 pm

Quite bizarre. Post the site link so others can confirm that it's not limited to your devices.

Anubisoprema
Joomla! Apprentice
Joomla! Apprentice
Posts: 9
Joined: Wed Sep 04, 2013 11:11 pm

Re: Strange mobile problem, possible malware

Postby Anubisoprema » Thu Jun 29, 2017 5:48 pm

I have update Virtuemart to latest version and Joomla to 3.7.2 and now it doesn't redirect to "advertise pages", but it is still strange.

I have to tap like 5x back button, so it goes back, and now back and forward buttons sometimes doesn't work at all.

You can try it yourself here:

Code: Select all

http://box2.appleoprema.com/
Last edited by fcoulter on Thu Jun 29, 2017 7:08 pm, edited 1 time in total.
Reason: breaking links - please use code tag for this, it prevents automatic insertion of links

User avatar
websitedons
I've been banned!
Posts: 389
Joined: Sat May 27, 2017 9:42 am

Re: Strange mobile problem, possible malware

Postby websitedons » Thu Jun 29, 2017 6:41 pm

Maybe there is something local to the devices or network. I had no popups or ads when navigating backwards on iPhone or Galaxy. All worked smoothly.

Anubisoprema
Joomla! Apprentice
Joomla! Apprentice
Posts: 9
Joined: Wed Sep 04, 2013 11:11 pm

Re: Strange mobile problem, possible malware

Postby Anubisoprema » Thu Jun 29, 2017 9:28 pm

So you say you can go back with one click? Because I have no problem on this server with other joomla sites (even with the same identical web shop, only 3 month old, when I was still testing theme and everything), other joomla sites run without problem only this one gives me headache, and this one is only that matters :/

I have also Wordpress on this server, runs normally and OK, too.

If you do not have any problems getting back and you manage to go back with one press on back button, then that is great. What is important that visitors and memeber who'll buy are good with navigation trough site.

Thanks for helping me :)

User avatar
websitedons
I've been banned!
Posts: 389
Joined: Sat May 27, 2017 9:42 am

Re: Strange mobile problem, possible malware

Postby websitedons » Thu Jun 29, 2017 10:52 pm

It might be something happening periodically. I just visited again and now I see ads to gaming sites. There is definitely malware in there that is targeting mobile devices. Have you alerted template developer?
bad-ad.jpg
You do not have the required permissions to view the files attached to this post.

Anubisoprema
Joomla! Apprentice
Joomla! Apprentice
Posts: 9
Joined: Wed Sep 04, 2013 11:11 pm

Re: Strange mobile problem, possible malware

Postby Anubisoprema » Fri Jun 30, 2017 12:24 pm

does the hashtag sign has something to do with it? I see that when I enter on my mobile site, in my url address at the end there is hashtag sign, like this:

www.box2.appleoprema.com/#

Anubisoprema
Joomla! Apprentice
Joomla! Apprentice
Posts: 9
Joined: Wed Sep 04, 2013 11:11 pm

Re: Strange mobile problem, possible malware

Postby Anubisoprema » Fri Jun 30, 2017 12:38 pm

websitedons wrote:It might be something happening periodically. I just visited again and now I see ads to gaming sites. There is definitely malware in there that is targeting mobile devices. Have you alerted template developer?
bad-ad.jpg


I didn't, because theme is changed by me, and I think like 70% of it. I didn't touch any core data, but I have change a lot of css template files, and some .php file, but only to change some visual stuff. I have change it to look like I would like web site to look, didn't touch anything else.

I am familiar with css, php and html, so I know what to change and how to change, just this is the first time I found this problem in 10 and more years working with joomla and its theme/templates.
I have several malwares on my joomla site, but manage to clean them and protect site, but this one is new to me, and it is not detected by any "check malware" site.

twodor
Joomla! Fledgling
Joomla! Fledgling
Posts: 2
Joined: Mon Jul 10, 2017 10:43 am

Re: Strange mobile problem, possible malware

Postby twodor » Mon Jul 10, 2017 11:03 am

Hi,

I have the same problem with one of my Joomla website. The malware seems to appear only on android devices. I have the latest Joomla 3.7 version and always keep up with the updates. The theme is gk news.

@Anubisoprema: what modules do you have on your site, maybe we can find any similarities and discover the problem.

User avatar
mandville
Joomla! Master
Joomla! Master
Posts: 14583
Joined: Mon Mar 20, 2006 1:56 am
Location: The Girly Side of Joomla in Sussex

Re: Strange mobile problem, possible malware

Postby mandville » Mon Jul 10, 2017 11:16 am

Why not run the forum post assistant
http://forum.joomla.org/viewtopic.php?f=621&t=582860
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}

twodor
Joomla! Fledgling
Joomla! Fledgling
Posts: 2
Joined: Mon Jul 10, 2017 10:43 am

Re: Strange mobile problem, possible malware

Postby twodor » Mon Jul 10, 2017 3:34 pm

I found the solution!!

It seems to be a Gavick problem and the solution is: Disabling the "Use Cookie Consent plugin" in the template style eliminates the malware.

More info: https://www.gavick.com/forums/quark/mal ... urce-54291

User avatar
mandville
Joomla! Master
Joomla! Master
Posts: 14583
Joined: Mon Mar 20, 2006 1:56 am
Location: The Girly Side of Joomla in Sussex

Re: Strange mobile problem, possible malware

Postby mandville » Mon Jul 10, 2017 8:38 pm

I have put this on the VEL for wider publication
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}

DefaultPaul
Joomla! Fledgling
Joomla! Fledgling
Posts: 1
Joined: Wed Jul 19, 2017 10:14 pm

Re: Strange mobile problem, possible malware

Postby DefaultPaul » Wed Jul 19, 2017 10:18 pm

Thanks all! That sorted the problem for me. I had exactly the same issue with Gavick Technews template. 2 days of restoring backups, searching through code, getting nowhere until I found this thread.


Return to “Security in Joomla! 3.x”

Who is online

Users browsing this forum: No registered users and 5 guests