vb.org Archive - Malware was found on the forum

vb.org Archive (https://vborg.vbsupport.ru/index.php)

- vB3 General Discussions (https://vborg.vbsupport.ru/forumdisplay.php?f=111)

- - Malware was found on the forum - looking for advice / help (https://vborg.vbsupport.ru/showthread.php?t=259396)

losasso

02-24-2011 05:52 PM

Malware was found on the forum - looking for advice / help

One of my forums was hacked few days ago.

practical machinist .com

Google Webmaster tools keeps telling me that this code is present on my pages, but when i view the code, its nowhere to be found. It looks like its showing randomly on the forum and I never found it on any of the pages.

###script type="text / avascript" src="http://www. erikymkzf. co.
cc/ build.....? var"###

(original code is broken with spaces - not to be crackable)

- I checked Footer, header code, camper it with the test version we have for the website, nothing was found there.

- I run virus scan on the server - nothing was found

- We looked for that code in all files on the server - it was not found

- I also have VBSEO that I'm updating now and few Ad Managment modules that appear to be ok.

At that point we are not sure where to look and how to troubleshoot the problem

If anybody can help we are ready to pay.

Thank you

Lynne

02-24-2011 06:49 PM

Is this a Paid Request? If so, I need to move it to the appropriate forum. If it is not, then please remove any mention of payment.

losasso

02-25-2011 02:25 AM

Well i was trying to troubleshoot it and did a lot of things so far, So looking for advice.... I'm just ready to pay if somebody can help.

Can you point me to there, I will post a message there as well.

Thank you Lynne

BirdOPrey5

02-27-2011 05:21 PM

<a href="https://vborg.vbsupport.ru/forumdisplay.php?f=30" target="_blank">Request for Paid Services</a> forum- the last one on the forums page.

However bast advice would be to re-upload all your original VB files.

If it's still showing up it's likely been inserted into a template and is in the database so searching files for viruses won't help.

You need to "search all templates" in admincp or the database itself in the tempaltes table.

TNCclubman

02-27-2011 05:37 PM

If you had posted 'god help us' your thread would have to be moved to the religion forum...

jk

losasso

02-27-2011 10:16 PM

Its randomly showing up, and it finally showed up for me! See attached image with and without the code. When i check in the header, nothing is there

https://vborg.vbsupport.ru/external/2011/02/4.png

https://vborg.vbsupport.ru/external/2011/02/5.png

Nothing is inside the header files... other than this code...

HTML Code:

<if condition="$vboptions['externalrss']">

        <link rel="alternate" type="application/rss+xml" title="$vboptions[bbtitle] RSS Feed" href="external.php?type=RSS2" />

        <if condition="$show['foruminfo'] OR $show['threadinfo']">

                <link rel="alternate" type="application/rss+xml" title="$vboptions[bbtitle] - $foruminfo[title_clean] - RSS Feed" href="external.php?type=RSS2&amp;forumids=$foruminfo[forumid]" />

        </if>

</if>

jimjam

02-28-2011 11:48 AM

Hi, try this it worked for me

https://vborg.vbsupport.ru/showthrea...parse+template

BirdOPrey5

02-28-2011 12:40 PM

What's a header file? Do you mean header template? That looks nothing like my header template...

All times are GMT. The time now is 08:02 PM.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.01043 seconds Memory Usage 1,725KB Queries Executed 10 (?)
More Information
Template Usage: (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)bbcode_html_printable (1)footer (1)gobutton (1)header (1)headinclude (6)option (1)post_thanks_navbar_search (1)printthread (8)printthreadbit (1)spacer_close (1)spacer_open Phrase Groups Available: global postbit showthread	Included Files: ./printthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/class_bbcode_alt.php ./includes/class_bbcode.php ./includes/functions_bigthree.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete printthread_start bbcode_fetch_tags bbcode_create bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete printthread_post printthread_complete
Messages: