Administrative and Maintenance Tools - Check 4 Hack - Finds infected Datastore Entries

Many Users have Problems with infected Webservers.

I wrote a small Cron-Job that searches the datastore for possible infects and tried to repair them.

1.0 Initial relase with one check:
Checks if a base64 Code resists in the Datastore. If it's found in the pluginlist, the Datastore will be rebuild.

For more Checks, tell them. I'll add them.

The Cron Job will be started every 20 Min, and sends a Mail to the entered Mailadress, or if non entered, to the webmaster eMail-adress.

Install:

Upload the upload Directory and install the XML File.

German Version is also integrated.

If you want to check the Plugin, enable the Demo-Plugin which is installed, too. Only if it's enabled, the Check will find this.

If this Mod detects an infect, please do not lean back! Research it, and fix your security Hole!

[djbaxter]

Originally Posted by MentaL

I got no infected email just 3 blanks.

Did you enable the demo plugin to test it? If not, manually running the cron job will send the blank email unless you have a real infection somewhere.

[MentaL]

Im on vb3 and cannot find no place to enable the demo.

/EDIT
Corrupt Datastore found!


The following modules were infected:

vbindex_config

/edit , decoded and it says

<div class="smallfont" style="text-align: center">vBindex Copyright &copy; MMII - MMIV Winter Systems.</div>

[djbaxter]

Then you need to delete that file: vbindex_config - what is that, anyway? That's not part of vBulletin, as far as I know.

[Adrian Schneider]

Simply checking for "base64" seems like it would give a lot of false positives... There are lots of legitimate uses for encoding data.

It's a good idea, but I think the implementation needs to be refined a lot, otherwise users will end up confused and scared.

[Hoffi]

I did not use any AddOn that use the base64 Code in a plugin, so it works for me. If you know a plugin which uses this code, I can add some extra functionality that looks in which plugin the code is used.

If you got a blank email, I assume that some phrases are missing. eMails were only send, if base64 is found in the datastore.

[onealien]

installed and working....3.8.x

THANKS...

[djbaxter]

Originally Posted by onealien

installed and working....3.8.x

Hmmm... it installed and tests fine on a 3.8.3 forum where I am a tech admin, but that forum was re-infected with the filestore123.info redirect without triggering this add-on.

Cleared the datastore (you can do this by disabling and then re-enabling any product/plug-in) so the redirect is gone again. Will continue to monitor.

Added: see below https://vborg.vbsupport.ru/showpost....2&postcount=39

[CBrown]

Ok...

I ran this, and it's telling me: pluginlist is infected?

Exactly how would I go about double checking if this is correct or a false positive?

This seems odd.

Great add-on... Now just to wrap my head about what I got going on here.

[djbaxter]

Originally Posted by djbaxter

Hmmm... it installed and tests fine on a 3.8.3 forum where I am a tech admin, but that forum was re-infected with the filestore123.info redirect without triggering this add-on.

Cleared the datastore (you can do this by disabling and then re-enabling any product/plug-in) so the redirect is gone again. Will continue to monitor.

Ignore this. I checked further and discovered that the cron job wasn't running. Somehow it was set to run only on the 11th of the month instead of daily.

It does on fact work as it should in vBulletin 3.8.3.

[CBrown]

Just to be clear...

If you get a blank email -> Does that mean nothing was found?