Site Help: Hacked

[SVTCobraLTD]

Google sent me a notice that my site has been hacked. I have been trying to replace files to eliminate the issue but I have had no luck. I signed up for SiteLock and they did a scan but said it is deeply rooter, whatever that means. I am in need of help to find the issue and get this resolved. Any help or route I can take to get help would be greatly appreciated. Thank you.

www.PennMustangs.com

[Dave]

It's a bit hard to tell from our position, it could be hidden in plugins, files, hooks, etc.

You might want to create a paid service request here: https://vborg.vbsupport.ru/forumdisplay.php?f=30

[blind-eddie]

What made google think your site was hacked?

I registered to your site, seems as if you are having www issues as well. I was having issue surfing your site until I removed www from the URL.
I am not staying logged in anywhere.

Also, you are using vbadvanced v3.1.0. It is a vulnerability and you need to update it to 3.2.3

I would like to help you out, free of charge.

[Kane@airrifle]

filestore72 infection...

Resources:
https://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/4020207-please-help-hacked-vbulletin-redirect-to-filestore72-info

https://clients.urljet.com/knowledgebase/147/Fix-HOW-TO-FIX---Vbulletin-redirecting-to-filestore123com-version-2.html

https://clients.urljet.com/knowledgebase/138/Fix-vBulletin-4xx-Filestore123-Hack.html

[SVTCobraLTD]

What made google think your site was hacked?

I got an email about this from them regarding this.


I registered to your site, seems as if you are having www issues as well. I was having issue surfing your site until I removed www from the URL.
I am not staying logged in anywhere.

Not sure how to resolve this?


Also, you are using vbadvanced v3.1.0. It is a vulnerability and you need to update it to 3.2.3

I tried updating but keeping getting this error.
Database error in vBulletin 3.8.9:

Invalid SQL:

CREATE TABLE adv_pages_user (
pageid int(10) unsigned NOT NULL default '0',
userid int(10) unsigned NOT NULL default '0',
layout text NOT NULL,
UNIQUE KEY pageid (pageid,userid)
) TYPE=MyISAM;

MySQL Error : You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'TYPE=MyISAM' at line 6
Error Number : 1064
Request Date : Monday, March 27th 2017 @ 07:51:42 AM
Error Date : Monday, March 27th 2017 @ 07:51:42 AM
Script : http://pennmustangs.com/forums/XXXXXXXXXX/vbacmps_install.php
Referrer : http://pennmustangs.com/forums/XXXXXXX/vbacmps_install.php
IP Address : XXXXXX
Username : XXXXXXX
Classname : vB_Database
MySQL Version : 5.5.51-38.2

--------------- Added 1490619430 at 1490619430 ---------------

filestore72 infection...

Resources:
https://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/4020207-please-help-hacked-vbulletin-redirect-to-filestore72-info

https://clients.urljet.com/knowledgebase/147/Fix-HOW-TO-FIX---Vbulletin-redirecting-to-filestore123com-version-2.html

https://clients.urljet.com/knowledgebase/138/Fix-vBulletin-4xx-Filestore123-Hack.html

Thank you. I am working through these.

[blind-eddie]

Delete this line of code in the install file and try again

if (version_compare(MYSQL_VERSION, '4.0.18', '<'))
{
Also, change all instances of TYPE=MyISAM; to ENGINE=MyISAM;

[SVTCobraLTD]

Delete this line of code in the install file and try again

if (version_compare(MYSQL_VERSION, '4.0.18', '<'))
{

That gives me this error now...
Parse error: syntax error, unexpected '}' in /home1/XXX/public_html/forums/admincp/vbacmps_install.php on line 3608

[MarkFL]

Try removing the closing bracket that was associated with the if statement you removed.

[blind-eddie]

Sorry, this is what needs removed from the install file

if (version_compare(MYSQL_VERSION, '4.0.18', '<'))
{
$enginevar = 'TYPE';
}

[SVTCobraLTD]

Sorry, this is what needs removed from the install file

if (version_compare(MYSQL_VERSION, '4.0.18', '<'))
{
$enginevar = 'TYPE';
}

Still not working.

[blind-eddie]

My offer stands as stated in my 1st post, I will help you, free of charge.

If you want free help with your issues, set my account on your site with full acp access and set up a temporary FTP account and pm me the info.

[SVTCobraLTD]

My offer stands as stated in my 1st post, I will help you, free of charge.

If you want free help with your issues, set my account on your site with full acp access and set up a temporary FTP account and pm me the info.

Thank you. I would like to work through this so I can learn. My biggest issue is not knowing if it is removed or not. My next step is just completely replacing every file/plugin to insure the issue is removed.