Malware issue

[MrHorror]

Hi. So we are running a vbulletin 4.1.10 forum. We recently had some malware issues. I found two plugins marked vbulletin with long strings of code in the admin cp area. Deleted both of those. Also scrubbed the board for any html code in post replies, threads, etc. However, we still have an issue with popups appearing on the board whenever you click around.

The popups are originating from a site called deloplen.com. A cookie marked deloplen.com also appears in the cookies list in google chrome whenever you visit the board. So now that I've scrubbed the board, I need to know where else this malicious code might be hiding.

[Dave]

It's really hard to say from our side what you need to do to get rid of it since the malware can be very well hidden on the filesystem or database (injected into plugins, hooks, templates or language strings).

[MrHorror]

So here's what I did. I uploaded a backup database from June, deloplen.com cookie still existed. So I deleted all my vbulletin files and did a fresh upload of my forum folder from June. Deloplen cookie still exists. Not sure what to do next.

[Dave]

When I Google "deloplen", I only find results that indicate it's an infection on your browser/PC, not malware in the software itself. I'd try a full system scan with Malwarebytes to be sure.

See https://www.pcrisk.com/removal-guides/15043-deloplen-com-pop-up-ads

[MrHorror]

I only run into this cookie on our vbulletin forum though. Nowhere else. It's exclusive to the forum only. I've visited other vbulletin forums just to make sure. The cookie only appears on our forum. I have a question though. Is there any way to sever the connection between the cookie and our forum using a code in .htaccess file or something similar? There has to be a way to block a specific url or specific cookie from the forum entirely right?

[x iJailBreak x]

I only run into this cookie on our vbulletin forum though. Nowhere else. It's exclusive to the forum only. I've visited other vbulletin forums just to make sure. The cookie only appears on our forum. I have a question though. Is there any way to sever the connection between the cookie and our forum using a code in .htaccess file or something similar? There has to be a way to block a specific url or specific cookie from the forum entirely right?

If you've replaced all files with clean ones and restored the database, try switching out your cookie prefix in config.php and while it won't delete the cookie, it *should* stop it functioning with your site.

If this doesn't work, you likely have another plugin that has been modified that is running the malicious code.