Emergency: Malware injection

[lycheepassion]

As of Weds my forum has been injected with directmarketingprompt.in malware


. I did an upgrade to 4.11 patch 1 from 4.1.0 (er I mean the last version before the latest with the patch) and then did a scan on Sucuri and it showed clean now it's not anymore. How can I fix this?

Here's the google diagnostic page
http://preview.tinyurl.com/gdiagno

Here's the sucuri report:

http://preview.tinyurl.com/sucscan

Here's my site:

http://preview.tinyurl.com/d4maq8n

Just disabled mods, ran suspect files, not sure what to do.> Thanks

[borbole]

Search the db for any trace of the injected code and remove them if found. Run a check of your server space as well and then contact your host so they can check things on their end as well.

[lycheepassion]

thanks VB May have fixed it. How would I run a db search?

[santi00]

I have a big problem. I think is the same.
If i clean the cookies and cache on the browser, then i go on my forum by google (searcing one of my keywords) and when i click on my site from google serp. I went redirect on http://file2store.info.
VB 4.1.11 and vbseo 3.5
Another italian friend has tried to upload vbseo and remove all plugin but the problem is the same.

Whitch is the solution?

[gazza2008]

I am having the same problem

I think if you upgrade to the vb 4.1.11 patch that might do it

If anyone else has any ideas let me know

[santi00]

Incredible that a vbulletin has this bug..... there'wes in a last version (vb 3.X) but i hope with the 4.x version the bug was resolved. Now i can see that the bug is always....incredible.

[K a M a L]

santi00 and gazza2008
if you have any of these mods installed (vBActivity, vBShout, Forumon RPG, vBDownloads and vBQuiz)
there is an XSS vulnerability on them
if not there is an Xss vulnerability on Ckeditor , and you should upgrade to latest Patch level

[santi00]

I haven't these mods installed and ckeditor.
The proble are in a lot of forum. Incredible because vbulletin is a commercial software.
INCREDIBLE.

[Pandemikk]

I.n.c.r.e.d.i.b.l.e

[K a M a L]

Could you give me an infected site url , to check for the reason ?