The Arcive of Official vBulletin Modifications Site.

Check 4 Hack - Finds infected Datastore Entries · **Released**: 06-26-2011

Many Users have Problems with infected Webservers.

I wrote a small Cron-Job that searches the datastore for possible infects and tried to repair them.

1.0 Initial relase with one check:
Checks if a base64 Code resists in the Datastore. If it's found in the pluginlist, the Datastore will be rebuild.

For more Checks, tell them. I'll add them.

The Cron Job will be started every 20 Min, and sends a Mail to the entered Mailadress, or if non entered, to the webmaster eMail-adress.

Install:

Upload the upload Directory and install the XML File.

German Version is also integrated.

If you want to check the Plugin, enable the Demo-Plugin which is installed, too. Only if it's enabled, the Check will find this.

If this Mod detects an infect, please do not lean back! Research it, and fix your security Hole!

djbaxter · #42 07-11-2011, 08:28 PM

Quote:

Originally Posted by CBrown

Just to be clear...

If you get a blank email -> Does that mean nothing was found?

Yes. The only time I get this is after a manual run and when I check for "infections" using other methods the datastore is clean.

thincom2000 · #43 07-11-2011, 09:29 PM

Quote:

Originally Posted by MentaL

The following modules were infected:

vbindex_config

/edit , decoded and it says

Quote:

Originally Posted by djbaxter

Then you need to delete that file: vbindex_config - what is that, anyway? That's not part of vBulletin, as far as I know.

I would not recommend removing that as it looks like it is the copyright notice for a mod you have installed. If you remove it, you can get in trouble with the mod author. Most mods with copyrights say if you don't want the copyright shown, pay to remove it or uninstall the mod.

Lee G · #44 07-26-2011, 11:11 PM

Two blank emails tonight, twenty minutes apart
In the logs it showed pluginlist being hit

Lee G · #45 07-26-2011, 11:38 PM

Looks like it was either this mod that set it off
https://vborg.vbsupport.ru/showthread.php?t=258158

Soon as I uninstalled the mod, the warnings stopped

BirdOPrey5 · #46 07-27-2011, 10:42 AM

Envolve does have the string "base64" in plugin code, but they are encoding data not php code.

gregorym · #47 01-31-2012, 10:26 AM

Just installed like a charm on 3.8x.
The demo worked well, now hopefully nothing is going to happen....
Thanks, simple but looks very useful.

neverstop · #48 03-01-2012, 06:16 PM

I installed this mod and I'm getting a blank email everytime the cron runs. Any thoughts?

Schoelle · #49 03-02-2012, 03:19 PM

Quote:

Originally Posted by neverstop

I installed this mod and I'm getting a blank email everytime the cron runs. Any thoughts?

This is from the demo plugin. Disable it and you will get no more emails.

farhanisfarhan · #50 03-03-2012, 06:16 PM

does it helps with file2store exploit as well ?

Lazorbeam · #51 03-05-2012, 02:12 PM

I'm getting a blank email once a day. Is this normal? Demo disabled.

Quote:

Originally Posted by farhanisfarhan

does it helps with file2store exploit as well ?

It should. The file2store exploit does exactly what this mod is designed to delete.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.06114 seconds Memory Usage 2,333KB Queries Executed 28 (?)
More Information
Template Usage: (1)SHOWTHREAD (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)ad_showthread_beforeqr (5)bbcode_quote (1)footer (1)forumjump (1)forumrules (1)gobutton (1)header (1)headinclude (1)modsystem_post (1)navbar (4)navbar_link (120)option (1)pagenav (1)pagenav_curpage (4)pagenav_pagelink (11)post_thanks_box (7)post_thanks_box_bit (11)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (1)post_thanks_postbit (11)post_thanks_postbit_info (10)postbit (1)postbit_attachment (11)postbit_onlinestatus (11)postbit_wrapper (1)spacer_close (1)spacer_open (1)tagbit_wrapper Phrase Groups Available: global inlinemod postbit posting reputationlevel showthread	Included Files: ./showthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_postinfo_query fetch_postinfo fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showthread_start showthread_getinfo forumjump showthread_post_start showthread_query_postids showthread_query bbcode_fetch_tags bbcode_create showthread_postbit_create postbit_factory postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start fetch_musername post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end post_thanks_function_fetch_thanks_bit_start post_thanks_function_show_thanks_date_start post_thanks_function_show_thanks_date_end post_thanks_function_fetch_thanks_bit_end post_thanks_function_fetch_post_thanks_template_start post_thanks_function_fetch_post_thanks_template_end postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_attachment postbit_display_complete post_thanks_function_can_thank_this_post_start pagenav_page pagenav_complete tag_fetchbit_complete forumrules navbits navbits_complete showthread_complete
Messages:

8 благодарности(ей) от:
djbaxter, fahris, furnival, Lee G, strudinox, TheLastSuperman, Toxic2

The Arcive of Official vBulletin Modifications Site.

It is not a VB3 engine, just a parsed copy!