Strange URL - Urgent help

[evelynpriscilla]

For the past one week, my forum and thread url has some strange characters at the end.
http://www.mysite.com/forums/forum.php#.UvGLWvs-2E0

Any idea what could be adding this at the end of the url ?

My hosting company gave me warning that my site is affecting other sites on the server. Could this be the one causing issues? Has anyone faced this before. My host is threatening to take permanent action :-(
Thanks for the help.


Thanks.

[ozzy47]

First you need to follow our advisory about deleting the install folder off your forums.

Then please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked

http://www.vbulletin.com/forum/blogs...vbulletin-site

Also please see these recent security announcements:

vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions

[Seven Skins]

These number #.UvGLWvs-2E0 are added by a hack to track who has copied your links etc.

e.g. addthis.com or tynt.com etc...

Have you recently added any of these kind of hacks?

[evelynpriscilla]

Thanks a lot ozzy. I deleted the install folders few months back. I will read the blogs. Thanks a lot for the links.

--------------- Added [DATE]1391734998[/DATE] at [TIME]1391734998[/TIME] ---------------

Originally Posted by Seven Skins

These number #.UvGLWvs-2E0 are added by a hack to track who has copied your links etc.

e.g. addthis.com or tynt.com etc...

Have you recently added any of these kind of hacks?

Yes seven skins I have addthis.com. I can see online that it adds those additional characters. I found out how to remove those characters. By changing the code addressbar URL = false. Now the strange characters are gone.

Will ADD THIS also cause hostgator to give me this warning? Any ideas? Then I can remove it entirely.

Both of your help is much appreciated. Thanks.

[ozzy47]

Perhaps you have something else going on with your site, try a scan with this, http://sucuri.net/ and see if you get any results.

[Seven Skins]

From addthis script remove this line and hostgator should leave you alone after this.

<script type="text/javascript">var addthis_config = {"data_track_addressbar":true};</script>

[evelynpriscilla]

Originally Posted by ozzy47

Perhaps you have something else going on with your site, try a scan with this, http://sucuri.net/ and see if you get any results.

I did the scan and there was no problem. Thanks Ozzy for the link. I am going to scan regularly.

Originally Posted by Seven Skins

From addthis script remove this line and hostgator should leave you alone after this.

<script type="text/javascript">var addthis_config = {"data_track_addressbar":true};</script>

Originally Posted by evelynpriscilla

By changing the code addressbar URL = false. Now the strange characters are gone.

Thanks Seven Skins, Add this was the problem. I waited for a week to give update because I waited to see if hostgator sends me any notification. Instead of removing this line, I changed the true to false.

Thank you both once again. :up: I was very tensed.

[ForceHSS]

Originally Posted by ozzy47

Perhaps you have something else going on with your site, try a scan with this, http://sucuri.net/ and see if you get any results.

You should read this about that site

[RichieBoy67]

Yeah, this looks like Tynt to me. Look for it in your headincludes template and delete it. i had this issue as well and it took me awhile to figure it out.

If it is Tynt I doubt it is effecting your server.

--------------- Added [DATE]1392319508[/DATE] at [TIME]1392319508[/TIME] ---------------

Originally Posted by evelynpriscilla

I did the scan and there was no problem. Thanks Ozzy for the link. I am going to scan regularly.





Thanks Seven Skins, Add this was the problem. I waited for a week to give update because I waited to see if hostgator sends me any notification. Instead of removing this line, I changed the true to false.

Thank you both once again. :up: I was very tensed.

Didn't see this. Glad you got it working. I had the same type of url with Tynt. I no longer use it as I do not want my link every where on any old site.

[ozzy47]

Originally Posted by ForceHSS

You should read this about that site

I have quite a bit in my htaccess and have not received any warnings from them, but I am sure that may not be true for everyone.