vBulleting hacked by Quiettorture?

[HawKe]

I'm having a very tough time figuring out exactly whether or not my instance of vBulletin has somehow been compromised or hacked (v3.6.8). Several (more than a few) of my members have alerted me that they are getting redirected to a dead website when visiting our forums with IE7. A few have indicated it happening on other vBulletin sites, but it does not happen anywhere else (non-vBulletin browsing).

The site they are being redirected to is www DOT quiettorture DOT com which appears to be dead. It also seems to be the site of a runescape clan according to a YouTube video.

If you Google it, please watch out for unsavory sites.

Here is what I can dig up so far:

Feedback from the thread on our site: http://forums.audioholics.com/forums...ad.php?t=41997

Another Italian thread that encountered it...

...and so did this site: http://www.e-budo.com/forum/showthread.php?p=460906

I'd love any feedback the community might have...

[SEOvB]

check your templates for redirects

[fmntprsv]

Hi, some users of my forum also talks the same. Curiously i don´t see this. I have vb 3.6.8 Patch 1, and also i have read the same of Hawke.

¿Anybody have this issue? Thanks in advance

[Dismounted]

Did you read FRDS's post?

[fmntprsv]

Yes dismounted i did read it. The template that i have used for more than four months and this issue happens since three days.

Thanks in advance

[Dismounted]

Yes, but if the hacker put arbitrary code into your templates, you wouldn't know but it'd still be there.

[fmntprsv]

Ok, i was search in the template for quiettorture, torture, quiet and only obtain this:

newreply_reviewbit_ignore_global

<phrase 1="$post[username]">$vbphrase[administrator_decided_x_quiet]</phrase>

and

postbit_ignore_global

<table id="post$post[postid]" class="tborder" cellpadding="$stylevar[cellpadding]" cellspacing="$stylevar[cellspacing]" border="0" width="100%" align="center">
<tr title="<phrase 1="$post[postid]">$vbphrase[post_x]</phrase>">
<td class="thead" style="font-weight:normal" $post[scrolltothis]>
<if condition="$show['inlinemod']">
<input type="checkbox" name="plist[$postid]" id="plist_$postid" style="float:$stylevar[right]; vertical-align:middle; padding:0px; margin:0px 0px 0px 5px" value="$post[checkbox_value]" onclick="inlineMod.toggle(this)" />
</if>
<a style="float:$stylevar[right]" href="showpost.php?$session[sessionurl]p=$post[postid]" target="_blank" rel="nofollow" onclick="return display_post($post[postid]);">$vbphrase[view_post]</a>
<a name="post$post[postid]"><img class="inlineimg" src="$stylevar[imgdir_statusicon]/post_$post[statusicon].gif" alt="$post[statustitle]" border="0" /></a>
$post[postdate]<if condition="!$show['detailedtime']">, $post[posttime]</if> $post[firstnewinsert]
</td>
</tr>
<tr>
<td class="alt2">
<a href="member.php?$session[sessionurl]u=$post[userid]">$post[musername]</a>
</td>
</tr>


<tr>
<td class="alt1">
<if condition="$show['moderated']">
<div style="float:$stylevar[right]"><img src="$stylevar[imgdir_misc]/moderated.gif" alt="$vbphrase[moderated_post]" border="0" /></div>
</if>
<if condition="$show['deletedpost']">
<div style="float:$stylevar[right]"><img src="$stylevar[imgdir_misc]/trashcan.gif" alt="$vbphrase[deleted_post]" border="0" /></div>
</if>
<div class="smallfont">
<phrase 1="$post[username]">$vbphrase[administrator_decided_x_quiet]</phrase>
</div>

</td>
</tr>
</table>

and

printthreadbit_ignore

<table class="tborder" cellpadding="$stylevar[cellpadding]" cellspacing="1" border="0" width="100%">
<tr>
<td class="page">

<table cellpadding="0" cellspacing="0" border="0" width="100%">
<tr valign="bottom">
<td style="font-size:14pt">$post[username]</td>
<td class="smallfont" align="$stylevar[right]">$post[postdate] $post[posttime]</td>
</tr>
</table>

<hr />

<if condition="$show['adminignore']">
<div class="smallfont">
<phrase 1="$post[username]">$vbphrase[administrator_decided_x_quiet]</phrase>
</div>
<else />
<div class="smallfont">
<phrase 1="$post[username]" 2="profile.php?$session[sessionurl]do=editlist">$vbphrase[message_hidden_x_on_ignore_list]</phrase></span>
</div>
</if>
</td>
</tr>
</table>
<br />

i thinks these instructions are legitimes of vbulletin...

Thanks in advance.. !

[Dismounted]

Look at your plugin list, is there anything unusual there? Also, look in your .htaccess file.

[fmntprsv]

Thanks for your interest dismounted, i?m going to check my plugins, and my .htaccess it?s correct.

Thanks again, but it?s possible that the problem it?s a new spyware, more info at: www.forospyware.com%2Ft135658.html%23post654024

[Phaedrus]

Check your actual index.php files and home.php files. If somebody gets your FTP password they can upload new php with redirects in them. They are relatively easy to clean up. This happened to my site a while back when my server company was compromised.