Check your plugin list, in phpmyadmin you can easily sort the tables to see which pluginid is last (i.e. newly added as it shows in the log record: 30144 smolinaro 12:06, 22nd Jun 2015 plugin.php add 178.73.196.73).
The part of the log in
red:
30147 smolinaro 12:14, 22nd Jun 2015 plugin.php edit
plugin id = 1869 178.73.196.73
^ Is the actual pluginid they modified so check that plugin asap and also in phpmyadmin sort by descending to see the last few plugins and check them as well. *Replace all default vBulletin files with 100% fresh vB files from a brand new .zip (download from
https://members.vbulletin.com) IMMEDIATELY AFTER removing any bad plugins, its best to do those two things within a few mins of each other to ensure whatever is present or was present can't come back i.e. if base64 code is in a .php shell file or similar that will simply make the code re-insert itself if they have scheduled tasks (cron jobs) calling the file to do just that etc.
06-24-2015, 01:30 PM
Threaded Mode