I never heard about problems of this kind.

I know however, that compromised sites may use links provided by Google as a trigger to move away from the original site, but has nothing to do with any application. It's just the way how the WORM works.

I suggest to change passwords for FTP, check plugins and also the styles (save one of them in order to refresh the plugin and style cache). During fixing compromised forums, I found plugin code in the plugin cache, but not in the plugin table.

Nevermind.

The mail notification showed me some code which is typical for malware. They change urls or text in the style cache, while the original style seems ok. In the specific case, they injected a script tag, which then moves the visitor away from your site. You can remove erratic style information in the cache by saving or reverting one template.

However, if you host an offending plugin, they can get in again and again. A good place to look at is the misc.php script, which offers a few entry points for highly advanced coders.

I'm running vBulletin Version 3.8.9 Patch Level 1 (last vB 3.x version that will run on my current OS).

Will Rotating Banner System v2.4.2 run on vB v3.8.9 pl1?

Or do I need to install an earlier RBS Version (and if so, what RBS Version)?

.

... thus it should run on 3.8 ... if it doesn't, it is safe not to use :)

I used this on vB 3.x.x, but now we have jumped up to 5.4.5. Will this mod work with new vB5 ?

I'm sorry, no.

Does anyone have this working on PHP 7 it seems to have broken a lot of extensions including this one.

Nevermind, I got it to work.

What did you fix? :)