done, thank you!

How do I mass change all user titles? they all say "Hacked by Team Animus"

Since this mod was quarantined and then restored, (with the claim to have been fixed) does that mean someone here (vbulletin.org) went thru the code line by line to verify the fix and see if the rest of the code is safe? Someone very clever. Was it in fact the mod or something else? Is 4.0.3 safe?

Not really, since it's an older version. But whatever vulnerability they've recently discovered seems to be in a lot of different versions.

People found a possible exploit in this mod, but it is now fixed. If sites are still being hacked then the exploit probably lies elsewhere. Nevertheless, this mod has now become tainted and I've got it disabled for now.

BTW, if you've got vb4 you shouldn't have this version installed anyway as it's for vb3.7.

Several people report that their site was hacked after installing the latest version of AFR. However, its unclear if this is related to this addon or not.

I think you misunderstood. The current version for this mod is 4.0.3. You are thinking about the forum.

I expect an official reply from someone on these forums. I'm more interested in a generic reply to what they do when they "restore" a mod. You would think they would inspect the code and approve it to be re-released. Is that what happens?

I've read this too. What's it mean exactly? How long after the update? Minutes? Hours?
And do they get hacked if they fix the breach and uninstall the mod?

Because this is the way I read their claims:

1. their vb forum was using this mod @v4.0.2
2. the forum was breached
3. they read it may be the mod at fault
4. they regain/clean their server/forums (one assumes!)
5. they install the "fixed" 4.0.3 mod
6. shortly after (minutes/hours?) they are hacked again
7. they still blame the mod.

To them I say redo step 4 and then disable/uninstall the mod.
See if you get hacked again.
Yes? ==> Most likely not the mod.
No? ==> Hmmmmm.... ==> Enable/install the mod and now see.

(Unless their server is still compromised because it wasn't "cleaned" properly.)

v4.0.3 - May 04. 2011.
-Security bug fixed

To update:
-Import XML, allow overwrite


If your site has been hacked please check out this post:
http://www.vbulletin.com/forum/showt...15#post2154415

Is the bug now definitely fixed? Or did the second hack happened over the installed backdoor? The current situation is a bit confusing.

They have added some files, created new user,...

To properly remove hacking traces please check link posted above.

I wasn't hacked, the situation is only a bit confusing since other people report that they was hacked (again) even after they upgraded the addon.