[zackw]

Originally Posted by y2ksw

Yeah I'm sure you didn't change in the way it is now, but I'm sure you created the part which follows the "hack". Because this script dows not make changes to the templates. Else, you could also say it is related to vBulletin or any other script you may have.

The WORM you got in your forums is changing whatever it pleases, it has nothing to do with any other legit script. Remove it (and the changes it made) and your forum behaves well.

"Remove it..." How does one find "it"? VB file checker only shows RBS files as suspicious. Should I delete them? Reinstall RBS?

I realize RBS doesn't change templates. And you know, html forms don't delete databases, but people have used insecure forms to do just that with SQL injection.
I doesn't matter what RBS "does" in normal operation, the question is whether things were hacked through it.

In any event, I edited the templates to remove the payload, but what other means can tell me where some worm is hiding?

I know this is probably not the thread to continue this, but if someone has a link to a method of validating the whole install, that would help.