My forums are being hijacked

[Lionel]

I posted about it last week but could not find the posts.

Strangely, in the posts (so far looks like it's only in the quotes) some words are being linked to some searchmiracle.php.

Some people here told me that I had spyware on my PC. Problem is I have not posted for one day, and everyone else sees those links. So could be that my users have the spyware. How do I prevent them to be transferred to forums?

[Marco van Herwaarden]

Could you provide a link to one of those posts and a test login.

[Lionel]

username test
password test

the first post on that page... words bank, radio, forum etc...
here

[Marco van Herwaarden]

What is overlib.js?

That is not a standard vB javascript file.

And my browser go totally crazy from all blocked cookies if i try to visit that page.

Edit: most blocked cookies are also because you where linking me to the www. version of your site, and all links/cookies use your site without www.

[Lionel]

overlib has been there for a while. it is being used to display certain texts in a box, like the geek's autolink

[Corriewf]

You have that hack enabled where you can link certain words right? If so I would chat with the coder and or check your coding. Can you access searchmiracle.php from your ftp? I would also notify vbulletin.com if all else fails as this could mean an exploit of some kind.

[Marco van Herwaarden]

I think those links are from a hack you installed: Geek Auto Linker.

Edit: Not hte only one with that answer

[Lionel]

Originally Posted by MarcoH64

What is overlib.js?


Edit: most blocked cookies are also because you where linking me to the www. version of your site, and all links/cookies use your site without www.

I am not sure I follow you on that

don't have searchmiracle anywhere in my coding... and this seems to happen only with a certain user.

Originally Posted by MarcoH64

I think those links are from a hack you installed: Geek Auto Linker.

Edit: Not hte only one with that answer

geek autolink displays all links differently

what is HTE?

the automerge keeps on posting in same post and uou might have missed it.

[Corriewf]

Its hard to tell because of the lang used but the coding for vbpager looks wrong and the searchmiracle is coming from coding from within.

Also wheres the code for the warning system?

<!-- checks for warning system --> <!-- end of warning system -->

I would check the code for the autolinker for the source of your problem.

[Lionel]

I just finished checking all codes. No mention of searchmiracle.php This seems to happen from quotes made by a specific user. Maybe she is the one who is infected and transfering to me?

At vb.com they are going to tell me no support because of the hacking.

Marco, 2 questions:

1-what is hte?

2-you just solved a cookie issue i had for the longest time and posted http://www.vbulletin.com/forum/showthread.php?t=141069

how can I have both? http://site and http://www.site ?