Help please!

[oldfan]

I haven't touched my vbulletin for over a year and all the sudden I'm getting these errors

Parse error: syntax error, unexpected 'DQokbXVybD0iaHR0cDovL3Byb2ZpbG' (T_STRING) in /home/oldfan/public_html/includes/class_bbcode.php on line 1879

Can someone please help me out? Thanks

[squidsk]

Has php recently been updated on your server? Is anyone else able to make changes, such as adding new custom bbcodes? It looks like there's a problem with one of those.

[oldfan]

Is there anyway of fixing this my forum wont work :(

[ForceHSS]

Link to site

[billstelling]

try adding this to your config file at the top below <?php.
add
define('SKIP_ALL_ERRORS', true);

While not a fix per say, it should get you on the site. If the server did update php it could trigger the warnings due to the changes with the newer php protocols.

[Lynne]

What version of vBulletin? What version of PHP? Have you tried redownloading a fresh set of files and then reuploading them? Did you follow the security bulletin sent out and delete your /install directory?

[oldfan]

Right now I cannot get the site to load at all.
My host said to reboot the server because the script/software is eating up all my RAm causing the server to crash. Once to reboot the other sites on the server load up fine but my site metallifukinca.com wont load up.After a few minutes the server goes offline and the other sites on the server wont load anymore. The hosting rolled back the php to see if that helps but it didnt help. I forget what version of vbulletin Im using its been so long since I looked at the files. As for the version of PHP, I have no clue, the webhost manager is all greek to me :( I just learned how to reboot the server today. To make matters worst im getting hundreds of emails a hour from my server saying the following.


Time: Thu Dec 19 10:12:44 2013 +0300
PID: 1625 (Parent PID:1624)
Account: oldfan
Uptime: 66 seconds


Executable:

/usr/bin/php


Command Line (often faked in exploits):

/usr/bin/php /home/oldfan/public_html/index.php


Network connections by the process (if any):

tcp: 199.233.233.24:54524 -> 146.247.24.12:80


Files open by the process (if any):



Memory maps by the process (if any):

00400000-00ccf000 r-xp 00000000 09:03 52576916 /usr/bin/php
00ecf000-00f54000 rw-p 008cf000 09:03 52576916 /usr/bin/php
00f54000-00f75000 rw-p 00000000 00:00 0
010b1000-012ed000 rw-p 00000000 00:00 0 [heap]
7f8003699000-7f800369d000 r-xp 00000000 09:03 52962748 /lib64/libnss_dns-2.5.so
7f800369d000-7f800389c000 ---p 00004000 09:03 52962748 /lib64/libnss_dns-2.5.so
7f800389c000-7f800389d000 r--p 00003000 09:03 52962748 /lib64/libnss_dns-2.5.so
7f800389d000-7f800389e000 rw-p 00004000 09:03 52962748 /lib64/libnss_dns-2.5.so
7f800389e000-7f80038a8000 r-xp 00000000 09:03 52962750 /lib64/libnss_files-2.5.so
7f80038a8000-7f8003aa7000 ---p 0000a000 09:03 52962750 /lib64/libnss_files-2.5.so
7f8003aa7000-7f8003aa8000 r--p 00009000 09:03 52962750 /lib64/libnss_files-2.5.so
7f8003aa8000-7f8003aa9000 rw-p 0000a000 09:03 52962750 /lib64/libnss_files-2.5.so
7f8003aa9000-7f8003ae4000 r-xp 00000000 09:03 52959445 /lib64/libsepol.so.1
7f8003ae4000-7f8003ce4000 ---p 0003b000 09:03 52959445 /lib64/libsepol.so.1
7f8003ce4000-7f8003ce5000 rw-p 0003b000 09:03 52959445 /lib64/libsepol.so.1
7f8003ce5000-7f8003cef000 rw-p 00000000 00:00 0
7f8003cef000-7f8003d04000 r-xp 00000000 09:03 52959405 /lib64/libselinux.so.1
7f8003d04000-7f8003f04000 ---p 00015000 09:03 52959405 /lib64/libselinux.so.1
7f8003f04000-7f8003f06000 rw-p 00015000 09:03 52959405 /lib64/libselinux.so.1
7f8003f06000-7f8003f07000 rw-p 00000000 00:00 0
7f8003f07000-7f8003f09000 r-xp 00000000 09:03 52959524 /lib64/libkeyutils-1.2.so
7f8003f09000-7f8004108000 ---p 00002000 09:03 52959524 /lib64/libkeyutils-1.2.so
7f8004108000-7f8004109000 rw-p 00001000 09:03 52959524 /lib64/libkeyutils-1.2.so
7f8004109000-7f8004111000 r-xp 00000000 09:03 52954520 /usr/lib64/libkrb5support.so.0.1
7f8004111000-7f8004310000 ---p 00008000 09:03 52954520 /usr/lib64/libkrb5support.so.0.1
7f8004310000-7f8004311000 rw-p 00007000 09:03 52954520 /usr/lib64/libkrb5support.so.0.1
7f8004311000-7f8004316000 r-xp 00000000 09:03 52963397 /usr/lib64/libXdmcp.so.6.0.0
7f8004316000-7f8004515000 ---p 00005000 09:03 52963397 /usr/lib64/libXdmcp.so.6.0.0
7f8004515000-7f8004516000 rw-p 00004000 09:03 52963397 /usr/lib64/libXdmcp.so.6.0.0
7f8004516000-7f8004518000 r-xp 00000000 09:03 52963369 /usr/lib64/libXau.so.6.0.0
7f8004518000-7f8004717000 ---p 00002000 09:03 52963369 /usr/lib64/libXau.so.6.0.0
7f8004717000-7f8004718000 rw-p 00001000 09:03 52963369 /usr/lib64/libXau.so.6.0.0
7f8004718000-7f800472f000 r-xp 00000000 09:03 52959460 /lib64/libaudit.so.0.0.0
7f800472f000-7f800492e000 ---p 00017000 09:03 52959460 /lib64/libaudit.so.0.0.0
7f800492e000-7f8004930000 rw-p 00016000 09:03 52959460 /lib64/libaudit.so.0.0.0
7f8004930000-7f8004946000 r-xp 00000000 09:03 52959622 /lib64/libpthread-2.5.so
7f8004946000-7f8004b46000 ---p 00016000 09:03 52959622 /lib64/libpthread-2.5.so
7f8004b46000-7f8004b47000 r--p 00016000 09:03 52959622 /lib64/libpthread-2.5.so
7f8004b47000-7f8004b48000 rw-p 00017000 09:03 52959622 /lib64/libpthread-2.5.so
7f8004b48000-7f8004b4c000 rw-p 00000000 00:00 0
7f8004b4c000-7f8004b5d000 r-xp 00000000 09:03 52962760 /lib64/libresolv-2.5.so
7f8004b5d000-7f8004d5d000 ---p 00011000 09:03 52962760 /lib64/libresolv-2.5.so
7f8004d5d000-7f8004d5e000 r--p 00011000 09:03 52962760 /lib64/libresolv-2.5.so
7f8004d5e000-7f8004d5f000 rw-p 00012000 09:03 52962760 /lib64/libresolv-2.5.so
7f8004d5f000-7f8004d61000 rw-p 00000000 00:00 0
7f8004d61000-7f8004eb0000 r-xp 00000000 09:03 52959390 /lib64/libc-2.5.so
7f8004eb0000-7f80050b0000 ---p 0014f000 09:03 52959390 /lib64/libc-2.5.so
7f80050b0000-7f80050b4000 r--p 0014f000 09:03 52959390 /lib64/libc-2.5.so
7f80050b4000-7f80050b5000 rw-p 00153000 09:03 52959390 /lib64/libc-2.5.so
7f80050b5000-7f80050ba000 rw-p 00000000 00:00 0
7f80050ba000-7f800526d000 r-xp 00000000 09:03 54281998 /opt/xml2/lib/libxml2.so.2.9.0
7f800526d000-7f800546c000 ---p 001b3000 09:03 54281998 /opt/xml2/lib/libxml2.so.2.9.0
7f800546c000-7f8005476000 rw-p 001b2000 09:03 54281998 /opt/xml2/lib/libxml2.so.2.9.0
7f8005476000-7f8005477000 rw-p 00000000 00:00 0
7f8005477000-7f80054a8000 r-xp 00000000 09:03 52954489 /usr/lib64/libidn.so.11.5.19
7f80054a8000-7f80056a7000 ---p 00031000 09:03 52954489 /usr/lib64/libidn.so.11.5.19
7f80056a7000-7f80056a8000 rw-p 00030000 09:03 52954489 /usr/lib64/libidn.so.11.5.19
7f80056a8000-7f80056fe000 r-xp 00000000 09:03 54272326 /opt/curlssl/lib/libcurl.so.4.2.0
7f80056fe000-7f80058fd000 ---p 00056000 09:03 54272326 /opt/curlssl/lib/libcurl.so.4.2.0
7f80058fd000-7f8005900000 rw-p 00055000 09:03 54272326 /opt/curlssl/lib/libcurl.so.4.2.0
7f8005900000-7f8005902000 r-xp 00000000 09:03 52959393 /lib64/libcom_err.so.2.1
7f8005902000-7f8005b01000 ---p 00002000 09:03 52959393 /lib64/libcom_err.so.2.1
7f8005b01000-7f8005b02000 rw-p 00001000 09:03 52959393 /lib64/libcom_err.so.2.1
7f8005b02000-7f8005b26000 r-xp 00000000 09:03 52956637 /usr/lib64/libk5crypto.so.3.1
7f8005b26000-7f8005d25000 ---p 00024000 09:03 52956637 /usr/lib64/libk5crypto.so.3.1
7f8005d25000-7f8005d27000 rw-p 00023000 09:03 52956637 /usr/lib64/libk5crypto.so.3.1
7f8005d27000-7f8005db8000 r-xp 00000000 09:03 52954573 /usr/lib64/libkrb5.so.3.3
7f8005db8000-7f8005fb8000 ---p 00091000 09:03 52954573 /usr/lib64/libkrb5.so.3.3
7f8005fb8000-7f8005fbc000 rw-p 00091000 09:03 52954573 /usr/lib64/libkrb5.so.3.3
7f8005fbc000-7f8005fe8000 r-xp 00000000 09:03 52954478 /usr/lib64/libgssapi_krb5.so.2.2
7f8005fe8000-7f80061e8000 ---p 0002c000 09:03 52954478 /usr/lib64/libgssapi_krb5.so.2.2
7f80061e8000-7f80061ea000 rw-p 0002c000 09:03 52954478 /usr/lib64/libgssapi_krb5.so.2.2
7f80061ea000-7f80061ff000 r-xp 00000000 09:03 52962741 /lib64/libnsl-2.5.so
7f80061ff000-7f80063fe000 ---p 00015000 09:03 52962741 /lib64/libnsl-2.5.so
7f80063fe000-7f80063ff000 r--p 00014000 09:03 52962741 /lib64/libnsl-2.5.so
7f80063ff000-7f8006400000 rw-p 00015000 09:03 52962741 /lib64/libnsl-2.5.so
7f8006400000-7f8006402000 rw-p 00000000 00:00 0
7f8006402000-7f8006484000 r-xp 00000000 09:03 52962739 /lib64/libm-2.5.so
7f8006484000-7f8006683000 ---p 00082000 09:03 52962739 /lib64/libm-2.5.so
7f8006683000-7f8006684000 r--p 00081000 09:03 52962739 /lib64/libm-2.5.so
7f8006684000-7f8006685000 rw-p 00082000 09:03 52962739 /lib64/libm-2.5.so
7f8006685000-7f800668c000 r-xp 00000000 09:03 52962763 /lib64/librt-2.5.so
7f800668c000-7f800688c000 ---p 00007000 09:03 52962763 /lib64/librt-2.5.so
7f800688c000-7f800688d000 r--p 00007000 09:03 52962763 /lib64/librt-2.5.so
7f800688d000-7f800688e000 rw-p 00008000 09:03 52962763 /lib64/librt-2.5.so
7f800688e000-7f80068e0000 r-xp 00000000 09:03 54267817 /opt/pcre/lib/libpcre.so.0.0.1
7f80068e0000-7f8006ae0000 ---p 00052000 09:03 54267817 /opt/pcre/lib/libpcre.so.0.0.1
7f8006ae0000-7f8006ae1000 rw-p 00052000 09:03 54267817 /opt/pcre/lib/libpcre.so.0.0.1
7f8006ae1000-7f8006af0000 r-xp 00000000 09:03 52954223 /usr/lib64/libbz2.so.1.0.3
7f8006af0000-7f8006cef000 ---p 0000f000 09:03 52954223 /usr/lib64/libbz2.so.1.0.3
7f8006cef000-7f8006cf1000 rw-p 0000e000 09:03 52954223 /usr/lib64/libbz2.so.1.0.3
7f8006cf1000-7f8006d12000 r-xp 00000000 09:03 52957340 /usr/lib64/libjpeg.so.62.0.0
7f8006d12000-7f8006f12000 ---p 00021000 09:03 52957340 /usr/lib64/libjpeg.so.62.0.0
7f8006f12000-7f8006f13000 rw-p 00021000 09:03 52957340 /usr/lib64/libjpeg.so.62.0.0
7f8006f13000-7f8006f27000 r-xp 00000000 09:03 52959636 /lib64/libz.so.1.2.3
7f8006f27000-7f8007126000 ---p 00014000 09:03 52959636 /lib64/libz.so.1.2.3
7f8007126000-7f8007127000 rw-p 00013000 09:03 52959636 /lib64/libz.so.1.2.3
7f8007127000-7f800714a000 r-xp 00000000 09:03 52954394 /usr/lib64/libpng12.so.0.10.0
7f800714a000-7f800734a000 ---p 00023000 09:03 52954394 /usr/lib64/libpng12.so.0.10.0
7f800734a000-7f800734b000 rw-p 00023000 09:03 52954394 /usr/lib64/libpng12.so.0.10.0
7f800734b000-7f800735b000 r-xp 00000000 09:03 52963407 /usr/lib64/libXpm.so.4.11.0
7f800735b000-7f800755b000 ---p 00010000 09:03 52963407 /usr/lib64/libXpm.so.4.11.0
7f800755b000-7f800755c000 rw-p 00010000 09:03 52963407 /usr/lib64/libXpm.so.4.11.0
7f800755c000-7f8007661000 r-xp 00000000 09:03 52963405 /usr/lib64/libX11.so.6.2.0
7f8007661000-7f8007861000 ---p 00105000 09:03 52963405 /usr/lib64/libX11.so.6.2.0
7f8007861000-7f8007868000 rw-p 00105000 09:03 52963405 /usr/lib64/libX11.so.6.2.0
7f8007868000-7f80078e7000 r-xp 00000000 09:03 52962677 /usr/lib64/libfreetype.so.6.3.10
7f80078e7000-7f8007ae7000 ---p 0007f000 09:03 52962677 /usr/lib64/libfreetype.so.6.3.10
7f8007ae7000-7f8007aec000 rw-p 0007f000 09:03 52962677 /usr/lib64/libfreetype.so.6.3.10
7f8007aec000-7f8007af7000 r-xp 00000000 09:03 52959418 /lib64/libpam.so.0.81.5
7f8007af7000-7f8007cf6000 ---p 0000b000 09:03 52959418 /lib64/libpam.so.0.81.5
7f8007cf6000-7f8007cf7000 rw-p 0000a000 09:03 52959418 /lib64/libpam.so.0.81.5
7f8007cf7000-7f8007d3f000 r-xp 00000000 09:03 52959451 /lib64/libssl.so.0.9.8e
7f8007d3f000-7f8007f3f000 ---p 00048000 09:03 52959451 /lib64/libssl.so.0.9.8e
7f8007f3f000-7f8007f45000 rw-p 00048000 09:03 52959451 /lib64/libssl.so.0.9.8e
7f8007f45000-7f8008072000 r-xp 00000000 09:03 52959459 /lib64/libcrypto.so.0.9.8e
7f8008072000-7f8008271000 ---p 0012d000 09:03 52959459 /lib64/libcrypto.so.0.9.8e
7f8008271000-7f8008292000 rw-p 0012c000 09:03 52959459 /lib64/libcrypto.so.0.9.8e
7f8008292000-7f8008296000 rw-p 00000000 00:00 0
7f8008296000-7f8008298000 r-xp 00000000 09:03 52962737 /lib64/libdl-2.5.so
7f8008298000-7f8008498000 ---p 00002000 09:03 52962737 /lib64/libdl-2.5.so
7f8008498000-7f8008499000 r--p 00002000 09:03 52962737 /lib64/libdl-2.5.so
7f8008499000-7f800849a000 rw-p 00003000 09:03 52962737 /lib64/libdl-2.5.so
7f800849a000-7f80084a0000 r-xp 00000000 09:03 52963382 /usr/lib64/libltdl.so.3.1.4
7f80084a0000-7f80086a0000 ---p 00006000 09:03 52963382 /usr/lib64/libltdl.so.3.1.4
7f80086a0000-7f80086a1000 rw-p 00006000 09:03 52963382 /usr/lib64/libltdl.so.3.1.4
7f80086a1000-7f80086d8000 r-xp 00000000 09:03 54273760 /opt/libmcrypt/lib/libmcrypt.so.4.4.8
7f80086d8000-7f80088d8000 ---p 00037000 09:03 54273760 /opt/libmcrypt/lib/libmcrypt.so.4.4.8
7f80088d8000-7f80088dc000 rw-p 00037000 09:03 54273760 /opt/libmcrypt/lib/libmcrypt.so.4.4.8
7f80088dc000-7f80088e1000 rw-p 00000000 00:00 0
7f80088e1000-7f8008ab2000 r-xp 00000000 09:03 52959916 /usr/lib64/libmysqlclient.so.16.0.0
7f8008ab2000-7f8008cb2000 ---p 001d1000 09:03 52959916 /usr/lib64/libmysqlclient.so.16.0.0
7f8008cb2000-7f8008d04000 rw-p 001d1000 09:03 52959916 /usr/lib64/libmysqlclient.so.16.0.0
7f8008d04000-7f8008d05000 rw-p 00000000 00:00 0
7f8008d05000-7f8008d0e000 r-xp 00000000 09:03 52962732 /lib64/libcrypt-2.5.so
7f8008d0e000-7f8008f0d000 ---p 00009000 09:03 52962732 /lib64/libcrypt-2.5.so
7f8008f0d000-7f8008f0e000 r--p 00008000 09:03 52962732 /lib64/libcrypt-2.5.so
7f8008f0e000-7f8008f0f000 rw-p 00009000 09:03 52962732 /lib64/libcrypt-2.5.so
7f8008f0f000-7f8008f3d000 rw-p 00000000 00:00 0
7f8008f3d000-7f8008f59000 r-xp 00000000 09:03 52962691 /lib64/ld-2.5.so
7f800902a000-7f80090fa000 rw-p 00000000 00:00 0
7f800913b000-7f800914c000 rw-p 00000000 00:00 0
7f8009157000-7f8009159000 rw-p 00000000 00:00 0
7f8009159000-7f800915a000 r--p 0001c000 09:03 52962691 /lib64/ld-2.5.so
7f800915a000-7f800915b000 rw-p 0001d000 09:03 52962691 /lib64/ld-2.5.so
7fffc9905000-7fffc991a000 rw-p 00000000 00:00 0 [stack]
7fffc99c2000-7fffc99c4000 r-xp 00000000 00:00 0 [vdso]
ffffffffff600000-ffffffffff601000 r-xp 00000000 00:00 0 [vsyscall]

[Lynne]

Could you have been hacked? Have you checked your files to see if they are still default files? (Also, the version of vbulletin you run is on the top of the files.)

[oldfan]

vBulletin 4.1.5 Patch Level 1 is the version I have currently.
So the best thing I can do you upgrade by over righting the old files?

[TheLastSuperman]

I haven't touched my vbulletin for over a year and all the sudden I'm getting these errors

Parse error: syntax error, unexpected 'DQokbXVybD0iaHR0cDovL3Byb2ZpbG' (T_STRING) in /home/oldfan/public_html/includes/class_bbcode.php on line 1879

Can someone please help me out? Thanks

vBulletin 4.1.5 Patch Level 1 is the version I have currently.
So the best thing I can do you upgrade by over righting the old files?

Your site has been hacked, similar code and all as seen in this thread:
http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/4012392-help-both-forum-and-admin-panel-just-show-white-page

My post includes info on what to look for and how to fix i.e. you need to replace ALL files see my post for more info:
http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/4012392-help-both-forum-and-admin-panel-just-show-white-page?p=4012531#post4012531

Make sure you take your time and find all the shell scripts and hidden files they will be buried in several folders spanning multiple levels within and also spare admin accounts and several new plugins.

[oldfan]

thanks TheLastSuperman !
I've been having the same problem as describe in that thread.

thanks

--------------- Added 1387669400 at 1387669400 ---------------

thanks TheLastSuperman !
I've been having the same problem as describe in that thread.

thanks

Wouldnt it be easier to delete everything then reinstall? The database will still be intracted no?

[ozzy47]

No do not delete everything, you need to follow the instructions.

[oldfan]

im not sure what this means
Make sure you take your time and find all the shell scripts and hidden files they will be buried in several folders spanning multiple levels within and also spare admin accounts and several new plugins.

--------------- Added 1387670528 at 1387670528 ---------------

No do not delete everything, you need to follow the instructions.

Why wouldnt deleting the whole ball of wax work?
I have things in my /public_html/ I cant remember what their for or where I got them :(

[ozzy47]

By doing that you may make you site inaccessible, if there are things in there that are required for some of your mods to work.

Take your time and follow the instructions, don't look for a easy way out. :)

[Lynne]

If you want to delete it all, what I suggest you do is move all the files to another directory ( /test_move ?) and move it out of the public_hmtl file and then upload all new files. See if you site then runs. If you had any modifications that required files, then make sure you reupload all the files. Check that you can upload avatars and attachments. Check all functionality on your site, and if it works, turn it back on. If it all works for a week or so, then you can delete the other directory ( /test_move ) of the site you made.

[oldfan]

that sounds way better then the other way
thanks

If you want to delete it all, what I suggest you do is move all the files to another directory ( /test_move ?) and move it out of the public_hmtl file and then upload all new files. See if you site then runs. If you had any modifications that required files, then make sure you reupload all the files. Check that you can upload avatars and attachments. Check all functionality on your site, and if it works, turn it back on. If it all works for a week or so, then you can delete the other directory ( /test_move ) of the site you made.

--------------- Added 1387766324 at 1387766324 ---------------

Im guessing it didnt work :(

Forbidden

You don't have permission to access /index.php on this server.

Additionally, a 403 Forbidden error was encountered while trying to use an ErrorDocument to handle the request.

[oldfan]

Will I have to reload all my hack also. And is this why Im getting database errors?

http://www.metallifukinca.com/index.php

[ozzy47]

That is why u advised you not to take the easy way out.

[Lynne]

If you move all your files out of public_html and the reupload all new vbulletin files to the public_html directory, you will need to reupload all your modification files also. And, any style directories or smilies or avatars/attachments/icons, if stored in the filesystem.

[oldfan]

Im moved out the old files into another dir, then copied them back into the public_html. Then I uploaded the new vbulletin. I have yet to reup any mods/hacks. I'm guessing this is why I'm still getting errors

[Lynne]

Try disabling your modifications/plugins for now and see if you still have this problem.
Note: To temporarily disable the plugin system, edit includes/config.php and add this line right under <?php

define('DISABLE_HOOKS', true);

[oldfan]

I did that and I got the blank page and when I try and view forumdisplay.php I get this error

Fatal error: Cannot redeclare ty() (previously declared in /home/xxxxx/public_html/forumdisplay.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/oldfan/public_html/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1


Try disabling your modifications/plugins for now and see if you still have this problem.
Note: To temporarily disable the plugin system, edit includes/config.php and add this line right under <?php

define('DISABLE_HOOKS', true);

--------------- Added 1389042822 at 1389042822 ---------------

for some reason the files werent overwritten, now thats done I'm getting db errors.

http://www.metallifukinca.com/forumdisplay.php?11-VIDEO

I can login the admin cp. Is there a way to backup all members/posts/threads/ then delete and start over fresh?

--------------- Added 1389047425 at 1389047425 ---------------

Do you have to run the install files when upgrading?

[Lynne]

You've been hacked.

I'd check your plugins for some added one and check your administrators and see if one has been added. You've deleted your /install directory, right?

When you upgrade, you run the upgrade.php script, not the install.php script.