Administrative and Maintenance Tools - Check 4 Hack - Finds infected Datastore Entries

Many Users have Problems with infected Webservers.

I wrote a small Cron-Job that searches the datastore for possible infects and tried to repair them.

1.0 Initial relase with one check:
Checks if a base64 Code resists in the Datastore. If it's found in the pluginlist, the Datastore will be rebuild.

For more Checks, tell them. I'll add them.

The Cron Job will be started every 20 Min, and sends a Mail to the entered Mailadress, or if non entered, to the webmaster eMail-adress.

Install:

Upload the upload Directory and install the XML File.

German Version is also integrated.

If you want to check the Plugin, enable the Demo-Plugin which is installed, too. Only if it's enabled, the Check will find this.

If this Mod detects an infect, please do not lean back! Research it, and fix your security Hole!

[whodah]

So for now, I changed check4hack.php from:

vbmail($recipent,$vbphrase['c4h_subject'],construct_phrase($vbphrase['c4h_body'], implode(", ",$storages)));

to:

vbmail($recipent,"Something Wrong in forum dB!".$vbphrase['c4h_subject'],"Run Check 4 Hacking in Scheduled Task Manager. This auto-email messes up, but it runs OK 'by hand'.\n\n".construct_phrase($vbphrase['c4h_body'], implode(", ",$storages)));

It isn't a fix, and it isn't perfect. But at least instead of blank emails, you'll get a little guidance on what to do or what the email means.

[BirdOPrey5]

I'm not sure it will make a difference but I would try commenting out the line

echo $infect['title']."-";

(make it)

//echo $infect['title']."-";

instead.

echo will post data to the browser, it isn't something you usually want to do when running a scheduled task automatically, if used there should be a check to make sure it is being run manually.

The thing is, while it shouldn't be used best I can tell, I don't see why it would result in blank emails- but it's the only thing that sticks out at me right now.

[Wolver2]

I get this note as an email from the plugin:

The following modules were infected:

pluginlist

what do I do now? or how do I remove it

[whodah]

Originally Posted by Wolver2

I get this note as an email from the plugin:

The following modules were infected:

pluginlist

what do I do now? or how do I remove it

Try post #88 in this thread.

[whodah]

Originally Posted by BirdOPrey5

I'm not sure it will make a difference but I would try commenting out the line

echo $infect['title']."-";

(make it)

//echo $infect['title']."-";

instead.

echo will post data to the browser, it isn't something you usually want to do when running a scheduled task automatically, if used there should be a check to make sure it is being run manually.

The thing is, while it shouldn't be used best I can tell, I don't see why it would result in blank emails- but it's the only thing that sticks out at me right now.

Heya BirdOPrey5,

Thanks for the idea, but it didn't fix it.

[Wolver2]

@whodah thanks for pointing it out.

After ....
if (strpos($_SERVER['PHP_SELF'],"subscriptions.php")) {

eval(gzinflat
e(base64_decode('HJ3HkqNQEkU/Zzq
....

What do I do to remove it completely?

Btw below that code you posted a link to an exploit regarding /install folder.. but I never had an install folder there after installing

[whodah]

Originally Posted by Wolver2

@whodah thanks for pointing it out.

After ....
if (strpos($_SERVER['PHP_SELF'],"subscriptions.php")) {

eval(gzinflat
e(base64_decode('HJ3HkqNQEkU/Zzq
....

What do I do to remove it completely?

Btw below that code you posted a link to an exploit regarding /install folder.. but I never had an install folder there after installing

Heya,

Interesting on the install thing. For me, that is what I saw all the log files hit.

For removal: this thread helped a ton:
http://www.vbulletin.com/forum/forum...i-e-p0wersurge

In particular, post number 4.

And secondly, although a lot of it is the same, the 2nd post here:
http://www.vbulletin.com/forum/forum...madnet-edition

Especially bullet point #6 as the infected plugin was by author 'vbulletin'. (fake of course, and removed of course.)

[Wolver2]

@Whodah I tried the post nr. 4:

Atm trying to clean.. but im a newbie in this.. will report

[KHALIK]

I am also getting the following message on my vb 4.2.2 when I manually run cron job.

Check 4 Hacking

pluginlist-

Done.

Is this a standard message, indicating no infected files found?

Or is it saying pluginlist- is infected ?



Please help

[whodah]

Originally Posted by KHALIK

I am also getting the following message on my vb 4.2.2 when I manually run cron job.



Is this a standard message, indicating no infected files found?

Or is it saying pluginlist- is infected ?



Please help

Try post #88 in this thread.