From freifunk@sebastianmahlow.de Sun Dec 30 23:15:43 2018
From: Sebastian Mahlow <freifunk@sebastianmahlow.de>
To: nordwest@lists.ffnw.de
Subject: [Nordwest] Re: Malware auf der Homepage?
Date: Mon, 31 Dec 2018 00:14:53 +0100
Message-ID: <6db8e16f-a63e-244b-5f70-2256cced6702@sebastianmahlow.de>
In-Reply-To:
 <trinity-60f5712e-6cf4-4016-af46-c30fd9db2243-1546199483837@3c-app-gmx-bs57>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0371154131727434656=="

--===============0371154131727434656==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Es steht im Quelltext der Seite als:

<script
type=3D"text/javascript">window.popuplink_cfg_field=3D"wp_cfg_index";window.w=
p_cfg_index=3D{"url":"http:\/\/tiny.cc\/6zbfvy","switch":false,"cookie":{"nam=
e":"index_is_shown","expires":6000}}</script>

Du findest es wenn du nach tiny.cc suchst.

Der Ursprung scheint dieses Plugin hier zu sein.

<script type=3D'text/javascript'
src=3D'https://ffnw.de/wp-content/plugins/index/popuplink.js?ver=3D5.0.2'></s=
cript>

Gru=C3=9F,
Sebastian



Am 30.12.18 um 20:51 schrieb Christian B. via Nordwest:
> Hi,
> =C2=A0
> danke f=C3=BCrs K=C3=BCmmern.=C2=A0
> Leider ist es auch bei mir noch immer reproduzierbar.=C2=A0Safari unter OSX
> - im Privatmodus. Als normaler Nutzer wird es nicht angezeigt.
> =C2=A0
> Gru=C3=9F
> Christian
> *Gesendet:*=C2=A0Sonntag, 30. Dezember 2018 um 17:52 Uhr
> *Von:*=C2=A0"Marcel Westerholt via Nordwest" <nordwest(a)lists.ffnw.de>
> *An:*=C2=A0"Allgemeine Liste" <nordwest(a)lists.ffnw.de>
> *Cc:*=C2=A0"Marcel Westerholt" <marcel.westerholt(a)me.com>
> *Betreff:*=C2=A0[Nordwest] Re: Malware auf der Homepage?
> Ist bei mir leider immer noch!
>
> Von meinem iPhone gesendet
>
> > Am 30.12.2018 um 17:06 schrieb Marcel Westerholt via Nordwest
> <nordwest(a)lists.ffnw.de>:
> >
> > Ich probiere es gleich nochmal mit nem geleertem Browser.
> >
> > Von meinem iPhone gesendet
> >
> =C2=A0
> =C2=A0
>
> _______________________________________________
> Nordwest mailing list -- nordwest(a)lists.ffnw.de
> To unsubscribe send an email to nordwest-leave(a)lists.ffnw.de


--===============0371154131727434656==
Content-Type: text/html
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="attachment.html"
MIME-Version: 1.0

PGh0bWw+CiAgPGhlYWQ+CiAgICA8bWV0YSBodHRwLWVxdWl2PSJDb250ZW50LVR5cGUiIGNvbnRl
bnQ9InRleHQvaHRtbDsgY2hhcnNldD1VVEYtOCI+CiAgPC9oZWFkPgogIDxib2R5IHRleHQ9IiMw
MDAwMDAiIGJnY29sb3I9IiNGRkZGRkYiPgogICAgRXMgc3RlaHQgaW0gUXVlbGx0ZXh0IGRlciBT
ZWl0ZSBhbHM6PGJyPgogICAgPGJyPgogICAgPHNwYW4+Jmx0OzxzcGFuIGNsYXNzPSJzdGFydC10
YWciPnNjcmlwdDwvc3Bhbj4gPHNwYW4KICAgICAgICBjbGFzcz0iYXR0cmlidXRlLW5hbWUiPnR5
cGU8L3NwYW4+PSI8YSBjbGFzcz0iYXR0cmlidXRlLXZhbHVlIj50ZXh0L2phdmFzY3JpcHQ8L2E+
IiZndDs8L3NwYW4+PHNwYW4+d2luZG93LnBvcHVwbGlua19jZmdfZmllbGQ9IndwX2NmZ19pbmRl
eCI7d2luZG93LndwX2NmZ19pbmRleD17InVybCI6PGEgY2xhc3M9Im1vei10eHQtbGluay1yZmMy
Mzk2RSIgaHJlZj0iaHR0cDpcL1wvdGlueS5jY1wvNnpiZnZ5Ij4iaHR0cDpcL1wvdGlueS5jY1wv
NnpiZnZ5IjwvYT4sInN3aXRjaCI6ZmFsc2UsImNvb2tpZSI6eyJuYW1lIjoiaW5kZXhfaXNfc2hv
d24iLCJleHBpcmVzIjo2MDAwfX08L3NwYW4+PHNwYW4+Jmx0Oy88c3BhbgogICAgICAgIGNsYXNz
PSJlbmQtdGFnIj5zY3JpcHQ8L3NwYW4+Jmd0Ozxicj4KICAgIDwvc3Bhbj48YnI+CiAgICA8c3Bh
bj5EdSBmaW5kZXN0IGVzIHdlbm4gZHUgbmFjaCB0aW55LmNjIHN1Y2hzdC48L3NwYW4+PGJyPgog
ICAgPHNwYW4+PC9zcGFuPjxicj4KICAgIDxzcGFuPkRlciBVcnNwcnVuZyBzY2hlaW50IGRpZXNl
cyBQbHVnaW4gaGllciB6dSBzZWluLiA8L3NwYW4+PGJyPgogICAgPHNwYW4+PC9zcGFuPjxicj4K
ICAgIDxzcGFuPiZsdDtzY3JpcHQgdHlwZT0ndGV4dC9qYXZhc2NyaXB0JwpzcmM9JzxhIGNsYXNz
PSJtb3otdHh0LWxpbmstZnJlZXRleHQiIGhyZWY9Imh0dHBzOi8vZmZudy5kZS93cC1jb250ZW50
L3BsdWdpbnMvaW5kZXgvcG9wdXBsaW5rLmpzP3Zlcj01LjAuMiI+aHR0cHM6Ly9mZm53LmRlL3dw
LWNvbnRlbnQvcGx1Z2lucy9pbmRleC9wb3B1cGxpbmsuanM/dmVyPTUuMC4yPC9hPicmZ3Q7Jmx0
Oy9zY3JpcHQmZ3Q7PGJyPgogICAgPC9zcGFuPjxicj4KICAgIDxzcGFuPkdydcOfLDwvc3Bhbj48
YnI+CiAgICA8c3Bhbj5TZWJhc3RpYW48L3NwYW4+PGJyPgogICAgPHNwYW4+PC9zcGFuPjxicj4K
ICAgIDxicj4KICAgIDxicj4KICAgIDxkaXYgY2xhc3M9Im1vei1jaXRlLXByZWZpeCI+QW0gMzAu
MTIuMTggdW0gMjA6NTEgc2NocmllYiBDaHJpc3RpYW4KICAgICAgQi4gdmlhIE5vcmR3ZXN0Ojxi
cj4KICAgIDwvZGl2PgogICAgPGJsb2NrcXVvdGUgdHlwZT0iY2l0ZSIKY2l0ZT0ibWlkOnRyaW5p
dHktNjBmNTcxMmUtNmNmNC00MDE2LWFmNDYtYzMwZmQ5ZGIyMjQzLTE1NDYxOTk0ODM4MzdAM2Mt
YXBwLWdteC1iczU3Ij4KICAgICAgPG1ldGEgaHR0cC1lcXVpdj0iY29udGVudC10eXBlIiBjb250
ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9VVRGLTgiPgogICAgICA8ZGl2IHN0eWxlPSJmb250LWZh
bWlseTogVmVyZGFuYTtmb250LXNpemU6IDEyLjBweDsiPgogICAgICAgIDxkaXY+CiAgICAgICAg
ICA8ZGl2PkhpLDwvZGl2PgogICAgICAgICAgPGRpdj7CoDwvZGl2PgogICAgICAgICAgPGRpdj5k
YW5rZSBmw7xycyBLw7xtbWVybi7CoDwvZGl2PgogICAgICAgICAgPGRpdj5MZWlkZXIgaXN0IGVz
IGF1Y2ggYmVpIG1pciBub2NoIGltbWVyCiAgICAgICAgICAgIHJlcHJvZHV6aWVyYmFyLsKgU2Fm
YXJpIHVudGVyIE9TWCAtIGltIFByaXZhdG1vZHVzLiBBbHMKICAgICAgICAgICAgbm9ybWFsZXIg
TnV0emVyIHdpcmQgZXMgbmljaHQgYW5nZXplaWd0LjwvZGl2PgogICAgICAgICAgPGRpdj7CoDwv
ZGl2PgogICAgICAgICAgPGRpdj5HcnXDnzwvZGl2PgogICAgICAgICAgPGRpdj5DaHJpc3RpYW48
L2Rpdj4KICAgICAgICAgIDxkaXYgbmFtZT0icXVvdGUiIHN0eWxlPSJtYXJnaW46MTBweCA1cHgg
NXB4IDEwcHg7IHBhZGRpbmc6CiAgICAgICAgICAgIDEwcHggMCAxMHB4IDEwcHg7IGJvcmRlci1s
ZWZ0OjJweCBzb2xpZCAjQzNEOUU1OyB3b3JkLXdyYXA6CiAgICAgICAgICAgIGJyZWFrLXdvcmQ7
IC13ZWJraXQtbmJzcC1tb2RlOiBzcGFjZTsgLXdlYmtpdC1saW5lLWJyZWFrOgogICAgICAgICAg
ICBhZnRlci13aGl0ZS1zcGFjZTsiPgogICAgICAgICAgICA8ZGl2IHN0eWxlPSJtYXJnaW46MCAw
IDEwcHggMDsiPjxiPkdlc2VuZGV0OjwvYj7CoFNvbm50YWcsCiAgICAgICAgICAgICAgMzAuIERl
emVtYmVyIDIwMTggdW0gMTc6NTIgVWhyPGJyPgogICAgICAgICAgICAgIDxiPlZvbjo8L2I+wqAi
TWFyY2VsIFdlc3RlcmhvbHQgdmlhIE5vcmR3ZXN0IgogICAgICAgICAgICAgIDxhIGNsYXNzPSJt
b3otdHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpub3Jkd2VzdEBsaXN0cy5mZm53LmRl
Ij4mbHQ7bm9yZHdlc3RAbGlzdHMuZmZudy5kZSZndDs8L2E+PGJyPgogICAgICAgICAgICAgIDxi
PkFuOjwvYj7CoCJBbGxnZW1laW5lIExpc3RlIgogICAgICAgICAgICAgIDxhIGNsYXNzPSJtb3ot
dHh0LWxpbmstcmZjMjM5NkUiIGhyZWY9Im1haWx0bzpub3Jkd2VzdEBsaXN0cy5mZm53LmRlIj4m
bHQ7bm9yZHdlc3RAbGlzdHMuZmZudy5kZSZndDs8L2E+PGJyPgogICAgICAgICAgICAgIDxiPkNj
OjwvYj7CoCJNYXJjZWwgV2VzdGVyaG9sdCIKICAgICAgICAgICAgICA8YSBjbGFzcz0ibW96LXR4
dC1saW5rLXJmYzIzOTZFIiBocmVmPSJtYWlsdG86bWFyY2VsLndlc3RlcmhvbHRAbWUuY29tIj4m
bHQ7bWFyY2VsLndlc3RlcmhvbHRAbWUuY29tJmd0OzwvYT48YnI+CiAgICAgICAgICAgICAgPGI+
QmV0cmVmZjo8L2I+wqBbTm9yZHdlc3RdIFJlOiBNYWx3YXJlIGF1ZiBkZXIgSG9tZXBhZ2U/PC9k
aXY+CiAgICAgICAgICAgIDxkaXYgbmFtZT0icXVvdGVkLWNvbnRlbnQiPklzdCBiZWkgbWlyIGxl
aWRlciBpbW1lciBub2NoITxicj4KICAgICAgICAgICAgICA8YnI+CiAgICAgICAgICAgICAgVm9u
IG1laW5lbSBpUGhvbmUgZ2VzZW5kZXQ8YnI+CiAgICAgICAgICAgICAgPGJyPgogICAgICAgICAg
ICAgICZndDsgQW0gMzAuMTIuMjAxOCB1bSAxNzowNiBzY2hyaWViIE1hcmNlbCBXZXN0ZXJob2x0
IHZpYQogICAgICAgICAgICAgIE5vcmR3ZXN0IDxhIGNsYXNzPSJtb3otdHh0LWxpbmstcmZjMjM5
NkUiIGhyZWY9Im1haWx0bzpub3Jkd2VzdEBsaXN0cy5mZm53LmRlIj4mbHQ7bm9yZHdlc3RAbGlz
dHMuZmZudy5kZSZndDs8L2E+Ojxicj4KICAgICAgICAgICAgICAmZ3Q7PGJyPgogICAgICAgICAg
ICAgICZndDsgSWNoIHByb2JpZXJlIGVzIGdsZWljaCBub2NobWFsIG1pdCBuZW0gZ2VsZWVydGVt
CiAgICAgICAgICAgICAgQnJvd3Nlci48YnI+CiAgICAgICAgICAgICAgJmd0Ozxicj4KICAgICAg
ICAgICAgICAmZ3Q7IFZvbiBtZWluZW0gaVBob25lIGdlc2VuZGV0PGJyPgogICAgICAgICAgICAg
ICZndDs8L2Rpdj4KICAgICAgICAgIDwvZGl2PgogICAgICAgIDwvZGl2PgogICAgICAgIDxkaXY+
wqA8L2Rpdj4KICAgICAgICA8ZGl2IGNsYXNzPSJzaWduYXR1cmUiPsKgPC9kaXY+CiAgICAgIDwv
ZGl2PgogICAgICA8YnI+CiAgICAgIDxmaWVsZHNldCBjbGFzcz0ibWltZUF0dGFjaG1lbnRIZWFk
ZXIiPjwvZmllbGRzZXQ+CiAgICAgIDxwcmUgY2xhc3M9Im1vei1xdW90ZS1wcmUiIHdyYXA9IiI+
X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTm9yZHdlc3Qg
bWFpbGluZyBsaXN0IC0tIDxhIGNsYXNzPSJtb3otdHh0LWxpbmstYWJicmV2aWF0ZWQiIGhyZWY9
Im1haWx0bzpub3Jkd2VzdEBsaXN0cy5mZm53LmRlIj5ub3Jkd2VzdEBsaXN0cy5mZm53LmRlPC9h
PgpUbyB1bnN1YnNjcmliZSBzZW5kIGFuIGVtYWlsIHRvIDxhIGNsYXNzPSJtb3otdHh0LWxpbmst
YWJicmV2aWF0ZWQiIGhyZWY9Im1haWx0bzpub3Jkd2VzdC1sZWF2ZUBsaXN0cy5mZm53LmRlIj5u
b3Jkd2VzdC1sZWF2ZUBsaXN0cy5mZm53LmRlPC9hPgo8L3ByZT4KICAgIDwvYmxvY2txdW90ZT4K
ICAgIDxicj4KICA8L2JvZHk+CjwvaHRtbD4K

--===============0371154131727434656==--