Malware in misc.php

[adivor]

Goodmornig to all!

My version: vBulletin 3.8.5

I receive malware notifications on my forum, from 3 days :mad::mad:
Google webmaster notified me file misc.php infected and i compared this file with other misc.php file from my other forum, in differente server......same structure, same line, ecc.... no difference :eek::eek:

http://www.adivor.it/forum/misc.php?v=385&g=js

malware url: myfilestore.com


Any suggestion for remove this?

[snakes1100]

Looks to be the typical vbseo hack.

Hard to say which one they injected, but i would start with a standard file replacement of all your files, you will also need to check the DB itself for hack code.

[adivor]

I have a second forum with same version of vbulletin e vbseo.... can i move file from one to other?

Tipically file infected?

[snakes1100]

I wouldnt, id just upload new copies from your current version via the vbseo, vbulletin zip files.

[adivor]

100% solved....i suppose ;)

All files vbseo patchet PL2 uploaded...now appears ok

[snakes1100]

You need to find out how they got in, i would inspect your logs, which file did they modify?

[adivor]

I had read changelog in vbseo 3.2.2 pl2 , and most important point was security patch.... only this. i haven't time to see files one to one ... sorry

[snakes1100]

vbseo latest release is 3.6.1

[adivor]

I haven't license for 3.6.1 :-(