How to remove Linkbucks??

[CouponWCents]

This all of a sudden popped up directing all my links to linkbucks. I searched and it was in my footer. I have removed it twice but it still keeps popping up in the footer. How do I remove this for good?

[ozzy47]

If you did not install a mod to do this then:

First you need to follow our advisory about deleting the install folder off your forums.

Then please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked (http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked)

http://www.vbulletin.com/forum/blogs...vbulletin-site (http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site)

Also please see these recent security announcements:

vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5 (http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3991423-potential-vbulletin-exploit-vbulletin-4-1-vbulletin-5)
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions (http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3993204-vbulletin-5-connect-security-patches-released-all-versions)

[CouponWCents]

Yeah, I am not techie at all and hate to spend the money to have someone do this for me. Grrr thanks though!

[ozzy47]

Well they you may be between a rock and a hard place. If you don't feel comfortable doing it on your own, then the only option it to pay someone to clean it all up for you.

Should you decide to hire someone, make sure the price don't seem to good to be true. A few people on here have paid people to clean up after a hacker, only to get hit again, meaning they missed something somewhere.

[Evoklub]

Same problem, if anybody can help us, please pm.

(Did all of above, upgraded, etc, but the linkbucks redirection still there.)

[ozzy47]

So you followed each step, to the letter in the following posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked (http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked)

http://www.vbulletin.com/forum/blogs...vbulletin-site (http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site)

[Evoklub]

Ozzy, thanks, already did it, but now just found it: was in footer template. Removed the line with a linkbucks link, and now everything is nice again.

[ozzy47]

Good, glad you finally found out what the issue was, thanks for reporting you findings. :)

[CouponWCents]

I have removed it in the footer at least a dozen times but it keeps coming back...fyi...

[ozzy47]

Have you checked your cron jobs for any unknown ones, maybe it's there.