iframe injected into all templates

[dawges]

Originally Posted by snakes1100

I wasnt suggesting files, i suggested in your db.

I found a table called "settings" in my database that contained only one entry. The iframe. Should i delete the entire table?

[ozzy47]

I dunno if I would delete it, maybe rename it to x_settings to make sure it is not supposed to be used by a mod or something. Then check your site and see if the iframe is still in the footer.

[dawges]

Originally Posted by ozzy47

I dunno if I would delete it, maybe rename it to x_settings to make sure it is not supposed to be used by a mod or something. Then check your site and see if the iframe is still in the footer.

Oops, i didnt mean delete the table just the entry. I did that but the iframe remains. There are no more database entries with this hack that i can see.

[snakes1100]

vb4 uses setting, not settings, if the only entry in that table is the iframe, id nuke it after backing it up.

But he has to be calling that table & setting, you may have more to inspect than just that.

[dawges]

Originally Posted by snakes1100

vb4 uses setting, not settings, if the only entry in that table is the iframe, id nuke it after backing it up.

But he has to be calling that table & setting, you may have more to inspect than just that.

Just found it again in the "datastore" table. however its full of other settings. not sure how to remove it from there.

[snakes1100]

Try this https://vborg.vbsupport.ru/showthread.php?t=265866

Backup your db first.

Manually editing your datastore can be tricky.

[dawges]

Originally Posted by snakes1100

Try this https://vborg.vbsupport.ru/showthread.php?t=265866

Backup your db first.

Manually editing your datastore can be tricky.

I saw this addon many times but ignored it lol. what a dummy. I just installed it and ran it through scheduled tasks and it removed the iframe.

Thanks!

I still have no idea how I was hacked but apparently they couldn't do much. they didnt even edit my config file.

I changed all passwords
Installed admin panel firewall
and ran the hack fix

that seems to have done the trick.

[snakes1100]

Welcome

[ozzy47]

Glad to hear it is gone for now, hopefully it won't come back. Maybe they got one of the admin passwords or something, or it could have come from one of your mods, make sure hey are all up to date.

--------------- Added [DATE]1378344772[/DATE] at [TIME]1378344772[/TIME] ---------------

I would also recommend installing this mod, https://vborg.vbsupport.ru/showthrea...ght=vbsecurity

[dawges]

Originally Posted by ozzy47

Glad to hear it is gone for now, hopefully it won't come back. Maybe they got one of the admin passwords or something, or it could have come from one of your mods, make sure hey are all up to date.

--------------- Added [DATE]1378344772[/DATE] at [TIME]1378344772[/TIME] ---------------

I would also recommend installing this mod, https://vborg.vbsupport.ru/showthrea...ght=vbsecurity

This is very troubling. I just dont see how they got in. However, if you do a search on those hackers nicknames on Google you will see other admin suffering the same fate today. I hope they find this thread.

--------------- Added [DATE]1378345346[/DATE] at [TIME]1378345346[/TIME] ---------------