Hacked

[Terrablade]

I do. Working on it

[RichieBoy67]

ok, well the very first thing once you get it up is to scan it for shell scripts, etc.. start with webmaster tools.

I also do text searches on my pc when I have the files to find shell scripts or debase64 code. And if your server has cpanel there is usually a virus scanner that catches most of those scripts.

[Max Taxable]

Originally Posted by Terrablade

It wasnt that Always had them. This happened as soon as I installed those 2 new skins :/

Using "nulled" scripts isn't a very intelligent thing to do. Jus' sayin.

[RichieBoy67]

Originally Posted by Max Taxable

Using "nulled" scripts isn't a very intelligent thing to do. Jus' sayin.

True,

I cannot tell you how many hacked site I have repaired that were hacked through nulled versions of Vbseo or other scripts. It is not always easy to know though if those sites have a nulled version unless looking for it.

Those scripts though almost always have extra's added... it just may take the guy who put it there some time to find you but he can do so pretty easily with a Google search and then bam...

[Max Taxable]

Yep, lowlifes who null licensed scripts and software aren't doing it out of a sense of philanthropy.

[Terrablade]

clamav found nothing on homedir

[RichieBoy67]

Well it could just be an extra php file that a virus scanner would not catch. use the suspect versions under maintenance in the admincp and check those files to make sure they either belong to VB or the mods you have.

[TheLastSuperman]

Originally Posted by RichieBoy67

Well it could just be an extra php file that a virus scanner would not catch. use the suspect versions under maintenance in the admincp and check those files to make sure they either belong to VB or the mods you have.

Exactly (cannot catch comment) the issue about that is, some of these files are custom coded per site or revised every so often so if it's a new script chances are your anti-virus is not going to detect it (server level or even your personal anti-virus if you download files from your server to your pc) HOWEVER this is why they have the Suspect Files maintenance tools in the admincp.

On the note of suspect files, you should always compare your vBulletin files to that of the original files within the .zip - What is different?

- Well the only thing that should be different is added files from modifications so simply verify those were not modified, compare your "supposedly stock" vBulletin files to the same files in a fresh copy of the same version you were running and if nothing differs i.e. the vBulletin files match (filesize and upload timestamp/date should all be the same if not within a minute or two of each other, timestamps can help indicate a malicious file too) that of those in the .zip AND all modification file sizes match then what remains? Chances are those are the bad files but remember to clone the directory before making changes or deleting files.

[RichieBoy67]

Originally Posted by TheLastSuperman

Exactly (cannot catch comment) the issue about that is, some of these files are custom coded per site or revised every so often so if it's a new script chances are your anti-virus is not going to detect it (server level or even your personal anti-virus if you download files from your server to your pc) HOWEVER this is why they have the Suspect Files maintenance tools in the admincp.

On the note of suspect files, you should always compare your vBulletin files to that of the original files within the .zip - What is different?

- Well the only thing that should be different is added files from modifications so simply verify those were not modified, compare your "supposedly stock" vBulletin files to the same files in a fresh copy of the same version you were running and if nothing differs i.e. the vBulletin files match (filesize and upload timestamp/date should all be the same if not within a minute or two of each other, timestamps can help indicate a malicious file too) that of those in the .zip AND all modification file sizes match then what remains? Chances are those are the bad files but remember to clone the directory before making changes or deleting files.

Well said. I see why we call you superman.