vBFirewall v1.0

This is my first mod for vBulletin and I have tried to make it as better as I could.

Click Install If You Use it!!

What is vBFirewall?
Its a PHP script which blocks all kinds of attacks on your vBulletin Forum! Like: URL Poisoning, Remote File Inclusion, SQL Injection, XSS and other kinds of attacks.

I have tested each and every function of this mod before releasing it and have used it myself for 1 month

It has a attacker logger, which logs the IP and many details of the attacker so that you can reach him

This is still in beta version and I will add more features in it to make your vBulletin more secure Suggestions are always welcome.


How to install?

1) Go to Admin and Import the xml file product-firewall_vb_rs.xml using the plugin manager.
2) Keep an eye on the log file which can be found here: www.yourvbforumurl.com/logfile_worms.txt (This file will only be created when a attack occour)
3) Your website is now secure from hackers



Thanks

[TsirhCitna]

I installed this last night and had 14 emails this morning with basically no information. My log reads:

1||1229487186||||||||
1||1229487186||||||||
1||1229493626||||||||
1||1229493631||||||||
1||1229504466||||||||
1||1229504472||||||||
1||1229511852||||||||
1||1229511856||||||||
1||1229517334||||||||
1||1229517334||||||||

[Skyrider]

invisiblea, would be great if you'd reply to this thread as you haven't done so in a while.

[repairman jack]

Originally Posted by mac-warez

my logfile reads this

1||1228766931||||||||
1||1228767166||||||||

what does that mean?

This is all I'm receiving as well.

Also, even though I have the option turned on I can't view logfile_worms.txt. It's not being created or is not in my forums directory. Suggestions?

[denman75]

it seems to be working
this is what i got in my mailbox

Hello!

Hack Attempt has been successfully prevented for your vBulletin forums at:
http://bullterrierforum.nl

Report:
============================

1||1229937338||116.122.158.46||systempath=http://www.elitewheels.ru/images/stories/.cnn?||||libwww-perl/5.79

============================

if i paste the url and i visit this page i got a warning from nod32 that there is some sort of trojan
really weird imho .

but it seems to be working

[Orakk]

Originally Posted by allartech

thank you Orakk
I got same problem

waiting for

Your welcome AA.. :up:

invisiblea - Any updates on progress? If stumped, other coders may lend a hand if you ask ..

[invisiblea]

Sorry for late reply.. within 2-3 days new version will be out..

[denman75]

relax its holiday time
them few more hours wont be biggy

[akee]

hi!

i try this mod, and i get this worm:

1||1230274881||210.105.132.249||t=http://204.2.183.2/babycaleb/picture.htm?||||Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)

how can i kill this?

[vbplusme]

How do you know its a worm? The IP address is from Korea. What do you see on your site?

[vbplusme]

The ip address that is hosting the badguy script is in the US/Colorado

They list abuse@ntt.net to report abuses. To get them to kill off the hacker script. If you tried to access that html, you likely have had The trojan is loaded on your PC, looks like the name of the trojan is Trojan Horse Downloader.Generic8.COX. You might want to do a few searches to see how to remove it from your local system.

HTH