error on sub manager
 

When I click subscription manager in the admin area I get the following
by x00x_BOT

Linux host.XXXX.com 2.6.32-042stab078.28 #1 SMP Mon Jul 8 10:17:22 MSK 2013 x86_64
Then the option to upload a file.

If I turn off all plugins in the config file it fixes the issue. but when disabling them one by one it does not. How do I figure out which plugin is causing the issue?

Plugins are as follows:

vBulletin 4.2.2
BannedWords 1.2.1 With using "BannedWords" plugin, you can ban/deny some words/links(or their parts) from using in new posts/pm's. VB Plugin by LordOfWAR.

Country Moderations 3.0 Moderate New Users From Certain Countries

e360 Holiday 2.0.1 e360 Holiday

e360 SnowStorm / Smashing XmasLights 1.2.1 e360 SnowStorm / SmashingXmasLights

Forum Runner 4.2.2 Adds push notification for your users using Forum Runner on the iPhone/iPod/iPad. Also takes care of notifying users that your forum supports Forum Runner if they are viewing from a supported device.

Inactive User Reminder Emails 2.2.1 Sends emails out to inactive users encouraging them to re-visit the forum

Member Tracking 4.2.0.0 Track Member Visits

More Share Options TNG by BOP5 (Free Version) 3.2 Add more "Share" buttons to all forum pages.

Panjo 4.2.2 Classifieds integration that increases engagement, grows membership, and generates a new stream of revenue.

PostRelease 4.2.2 Official PostRelease plugin for vBulletin

Prevent Posting Of Links On User Group Per User Gr 1 It will allow you to enable and disable the ability to post links for user groups.

SEOforums.org Fuzzy SEO Booster 3 1.5.0b SEOforums.org Fuzzy SEO Booster 3

Separate Sticky and Normal Threads 1.1 Separate Sticky and Normal Threads

Skimlinks Plugin 4.2.2 Official Skimlinks plugin for vBulletin

Tapatalk 4.7.1 Tapatalk mobile app plugin for vb4.

Tapatalk - Who's Online 1.0.0 Shows the user as viewing the forum via Tapatalk rather than Unknown

UserCP Referral Link 0.1 Place a box in UserCP/Settings with a link for members to refer new people.

v3 Arcade 2.0.3 Professional vBulletin Gaming (vB4)

vBSEO :: Sitemap Generator 3.0 Generate a Google & Bing Sitemap for your Forums

vBulletin Blog 4.2.2 Personal web log, integrated with vBulletin.

vBulletin CMS 4.2.2 Content Management System

Word Links FREE by BOP5 VB4 2.0 Link words in posts, groups, visitor messages, and more to the URLs of your choice. (FREE VERSION)

Have you checked your system for infections? I believe your subscriptions system is still infected or you still have some remaining identities from an infection.

This is the x00x Bot list.
http://www.zone-h.org/archive/notifier=x00x_BOT


Double check your system by using the best practices listed below.

Then please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked
http://www.vbulletin.com/forum/blogs...vbulletin-site

Also please see these recent security announcements:
http://www.vbulletin.com/forum/forum...-1-vbulletin-5
http://www.vbulletin.com/forum/forum...d-all-versions

I am scanning the account now and have not found anything yet.

Turning off the plugs as suggested in your link does fix the issue but I am unsure of which plugin is infected.

Scanning... what scanning, may I ask?

the virus option in cPanel.

--------------- Added [DATE]1387211536[/DATE] at [TIME]1387211536[/TIME] ---------------

how can I find any remaining parts of this infection?

You need to carefully follow the recommendations I gave you. Be very thorough and do not take shortcuts or miss steps. It will resolve the issue.

I just followed all the instructions you listed and the issue is still there.
Not sure what to do from here.

How are you disabling plugins one by one? If you're just going through the product manager and disabling those one at a time that isn't the way you should proceed. You should go through the plugin manager where you can see each individual plugin for all products. Start disabling those one at a time, particularly focusing on any that aren't part of an installed product.

Ok I found it using the plugin manager :)

--------------- Added [DATE]1387371370[/DATE] at [TIME]1387371370[/TIME] ---------------

it was vBulletin ShELL By Cyber^rOot,
looks like it was added somehow.