Major issue: Old zip being corrupted.

**fafalone** · Feb 18th, 2024, 04:08 AM

This happened to one of mine and I thought, ok, *maybe* it was me, and somewhere I had a different copy that I had uploaded compared to the one in my project folders.

But now the exact same thing has happened to this .zip The trick uploaded: https://www.vbforums.com/showthread....=1#post5597152

I've confirmed it's not a browser issue by using different browsers on different devices.

Opening up the files, it appears some HTML got inserted ahead of the content. Some google "tag manager" thing was likely improperly set to modify .zip.

Code:

<!-- BEGIN GTM -->
<script>
console.log('TA GTM Tag');
var gtmID="GTM-TJD5FTH";(function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer',gtmID);
function docReady(fn) {
    // see if DOM is already available
    if (document.readyState === "complete" || document.readyState === "interactive") {
        // call on next available tick
        setTimeout(fn, 1);
    } else {
        document.addEventListener("DOMContentLoaded", fn);
    }
}
docReady(function() {
var firstElement = document.body.firstChild;
        var urlElement = "https://www.googletagmanager.com/ns.html?id";
        var gtmElement = document.createElement('noscript');
	var gtmIframe = document.createElement('iframe');
        gtmIframe.src = urlElement + gtmID;
        gtmIframe.style.width = '0';
        gtmIframe.style.height = '0';
	gtmIframe.style.cssText = 'display:none;visibility:hidden';
	gtmElement.appendChild(gtmIframe);
        firstElement.parentNode.insertBefore(gtmElement, firstElement);
})
</script>
<!--END GTM-->

Going through things, this issue is widespread.

**fafalone** · Feb 18th, 2024, 11:52 AM

This might be even worse than initially thought.

It's not just prepended... the server is truncating at the original file size. So the last couple KB are cut off, meaning there's no way to fix these files on our end.

I *really* hope the originals weren't modified or that there's backups. Because this is every zip on the site as far as I can see.

**VanGoghGaming** · Feb 18th, 2024, 01:15 PM

It's not just ZIPs, all images were affected as well.

**philo** · Feb 18th, 2024, 01:36 PM

Yes, also when downloading ancient stuff, the same corruption. It's like some kind of mal database injection.

Don't know if this is relevant, but it shows that cybercrooks have a handle on GTM scripts
Hackers Planting Credit Card Skimmers Inside Google Tag Manager Scripts
https://cybersecuritynews.com/hacker...card-skimmers/

I always keep UMatrix set to block GTM

Cloudflare analysis of:

https://www.googletagmanager.com/ns.html?id=GTM-TJD5FTH

https://radar.cloudflare.com/scan

downloads this:

<!DOCTYPE html><html lang="en"><head>
<meta charset="utf-8">
<title>ns</title>
</head>
<body>
<img src="//secure.quantserve.com/pixel/p-vPn77x7pBG57Y.gif" style="display:none;" border="0" height="1" width="1" alt="Quantcast">
</body></html>

**linhongye2010** · Feb 21st, 2024, 04:21 AM

Based on what I've had, the end of the attachments are squeezed out by some XML( and the previous content).

**jpbro** · Feb 21st, 2024, 07:19 AM

I've been able to confirm (for attachments mid-August 2012 and earlier at least*) that the attachment files are thankfully not corrupted on the file system - the data is being mangled in transit by the web server. You can get any pre-August 14-ish attachment as follows:

Make a note of the numeric portion of the user ID of the user that posted the attachment. For example, hovering over my user name shows this URL: https://www.vbforums.com/member.php?128698-jpbro so the number we're interested in is 128698.
Make a note of the pre-August 2012 attachment ID. For example, in this post of mine from 2011: https://www.vbforums.com/showthread....one-Calculator, hovering over the attachment link in the first post shows this URL: https://www.vbforums.com/attachment....3&d=1311197890 so the number we're interested in is 84913
Built the start of the URL as follows: https://www.vbforums.com/attachments/
The split the user ID into individual digits a add a forward slash after each digit: https://www.vbforums.com/attachments/1/2/8/6/9/8/
Append the attachment ID, followed by an extension of ".attach": https://www.vbforums.com/attachments...8/84913.attach
Change the extension of the downloaded file to ".zip" and you should now be able to open the ZIP archive without error.

* Thanks to EduardoVB for pinning down the date where the rules change for determining the attachment URL. Unfortunately we haven't found the new path algo yet.

**Arnoutdv** · Feb 21st, 2024, 07:32 AM

Thanks for sharing guys!

I managed to download the ZIP file from this codebank submission by dilettante:
https://www.vbforums.com/showthread....File-I-O-Class
Using this url:
https://www.vbforums.com/attachments...4/65379.attach

Thread: Major issue: Old zip being corrupted.

Thread Tools

Display

Major issue: Old zip being corrupted.

Re: Major issue: Old zip being corrupted.

Re: Major issue: Old zip being corrupted.

Re: Major issue: Old zip being corrupted.

Re: Major issue: Old zip being corrupted.

Re: Major issue: Old zip being corrupted.

Re: Major issue: Old zip being corrupted.

Posting Permissions