The Arcive of Official vBulletin Modifications Site.

Check 4 Hack - Finds infected Datastore Entries · **Released**: 06-26-2011

Many Users have Problems with infected Webservers.

I wrote a small Cron-Job that searches the datastore for possible infects and tried to repair them.

1.0 Initial relase with one check:
Checks if a base64 Code resists in the Datastore. If it's found in the pluginlist, the Datastore will be rebuild.

For more Checks, tell them. I'll add them.

The Cron Job will be started every 20 Min, and sends a Mail to the entered Mailadress, or if non entered, to the webmaster eMail-adress.

Install:

Upload the upload Directory and install the XML File.

German Version is also integrated.

If you want to check the Plugin, enable the Demo-Plugin which is installed, too. Only if it's enabled, the Check will find this.

If this Mod detects an infect, please do not lean back! Research it, and fix your security Hole!

baerwurz · #52 03-12-2012, 06:16 PM

Perfect for file2store exploit. Traffic went up. Thanks a lot

Zighinno · #53 03-16-2012, 11:48 AM

Hi, when click on run now the email is: The following modules were infected: pluginlist.

demo is disabled. Why?

Thanks

furnival · #54 03-21-2012, 03:42 PM

This seemed to fix my issue with the file2store exploit. But do I need to rebuild my templates too once in a while I wonder if I had that problem?

Once I disabled a couple of old plug ins I did not get any more security warnings by email.

I can't thank the coder of this app enough!

If anyone knows: does rebuilding the datastore slow down my forum for those visitors who visit immediately after it is rebuilt?

arcab4 · #55 03-22-2012, 09:02 PM

thanks for creating this. been having issues with file2store.info - those bastards.

thanks for the detailed instructions for newbies.
https://vborg.vbsupport.ru/showpost....5&postcount=26

alex818 · #56 04-03-2012, 01:43 PM

The following modules were infected:

pluginlist

what do we do now?

Baf_Jams · #57 04-03-2012, 08:25 PM

Quote:

Originally Posted by alex818

The following modules were infected:

pluginlist

what do we do now?

Did you enable the demo plugin to test it?

DAMINK · #58 04-05-2012, 11:00 PM

Great Mod.
Thankyou for taking the time to create this.
Works perfectly as expected.

Gadget_Guy · #59 04-19-2012, 03:28 AM

Here is something interesting.

I know I am 100% affected by the file2store exploit, however I am getting blank e-mails.

How is this possible?

D.

DAMINK · #60 04-19-2012, 03:53 AM

Arent blank emails only for the bebug mode?
I thought if it was running properly you get no emails?

Jhonnyf · #61 04-20-2012, 07:14 PM

I think That I found how happen the INJECTION SQL .. I'm testing on a Client and not have problem since 2 days (the day that I do the patch)

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.11094 seconds Memory Usage 2,330KB Queries Executed 26 (?)
More Information
Template Usage: (1)SHOWTHREAD (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)ad_showthread_beforeqr (1)bbcode_quote (1)footer (1)forumjump (1)forumrules (1)gobutton (1)header (1)headinclude (1)modsystem_post (1)navbar (4)navbar_link (120)option (1)pagenav (1)pagenav_curpage (4)pagenav_pagelink (11)post_thanks_box (7)post_thanks_box_bit (11)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (1)post_thanks_postbit (11)post_thanks_postbit_info (10)postbit (1)postbit_attachment (11)postbit_onlinestatus (11)postbit_wrapper (1)spacer_close (1)spacer_open (1)tagbit_wrapper Phrase Groups Available: global inlinemod postbit posting reputationlevel showthread	Included Files: ./showthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showthread_start showthread_getinfo forumjump showthread_post_start showthread_query_postids showthread_query bbcode_fetch_tags bbcode_create showthread_postbit_create postbit_factory postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start fetch_musername post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end post_thanks_function_fetch_thanks_bit_start post_thanks_function_show_thanks_date_start post_thanks_function_show_thanks_date_end post_thanks_function_fetch_thanks_bit_end post_thanks_function_fetch_post_thanks_template_start post_thanks_function_fetch_post_thanks_template_end postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_attachment postbit_display_complete post_thanks_function_can_thank_this_post_start pagenav_page pagenav_complete tag_fetchbit_complete forumrules navbits navbits_complete showthread_complete
Messages:

8 благодарности(ей) от:
djbaxter, fahris, furnival, Lee G, strudinox, TheLastSuperman, Toxic2

The Arcive of Official vBulletin Modifications Site.

It is not a VB3 engine, just a parsed copy!