FAQ Page is missing due to plugin?

[Lynne]

I don't know what you would look for in the database, perhaps Jason can explain that better.

Have you tried redownloading vbulletin from vb.com and the reuploading a fresh faq.php file to your site in ascii mode? Have you tried viewing the faq from a total default vb style?

I'm kinda at a loss here on what to suggest to you.

[King Kovifor]

Originally Posted by owlbill

Ok, now I am feeling a bit lost. What might I be looking for in the DB? I can view it also through cPanel BTW.

Not sure, I was just suggesting how you could do it without the backend access you were talking about.

[owlbill]

I am downloading the freshest VB 3.6.8 PL2 and will re-do the upload with that and report back here.

--------------- Added [DATE]1206206864[/DATE] at [TIME]1206206864[/TIME] ---------------

--------------------------
--------------------------

Ok, so after I uploaded all new VB non-iamge files ASCII etc., I even created a new No Parent style and chose it, this is what i get when i go to my index page:

Warning: Unknown(http://holta-racing.com/hacked.htm): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found in /index.php(540) : eval()'d code on line 2

Warning: Unknown(http://holta-racing.com/hacked.htm): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found in /index.php(540) : eval()'d code on line 2

Warning: (null)() [function.include]: Failed opening 'http://holta-racing.com/hacked.htm' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php') in /index.php(540) : eval()'d code on line 2

------------------------
------------------------

For what it's worth, line 540 of my index.php is:

eval('print_output("' . fetch_template('FORUMHOME') . '");');

Basically the same as the FAQ page, but calling of course to a different template.

[King Kovifor]

It seems like someone tried to "hack" your board and include hacked.htm. Is there a hook right before the fetch_template? And it may be within your global plugins since it is now affecting your index.php.

[owlbill]

The Hook in the faq.php before the fetch_template line is:

($hook = vBulletinHook::fetch_hook('faq_complete')) ? eval($hook) : false;

--------------- Added [DATE]1206213101[/DATE] at [TIME]1206213101[/TIME] ---------------

I wonder if reuploading the actual plug-in files would be better since the vb files seem to make no difference. Perhaps it is the plugin as you say that might be the problem.

[Lynne]

Have you done a search in your templates for "hacked" at all? I think that is what I would do next.

[owlbill]

Just searched templates for "hack" and "hacked" with no results.

[Lynne]

How about hacked.htm? You should be searching for '%hack%' perhaps to include all variations. Somehow, somewhere, it has the idea that it needs to include that file. So, you need to find out where it is calling that. I do all the file changes on my computer and then upload them to the server, so I guess if you do the same, I would go replace every single file with the copy you have on your computer.

Even when you finally get this fixed, you need to be thinking about security and how it is that this happened in the first place. Look at the modifications you have installed and make sure they are all up-to-date and read the threads to see if any issues have been brought forth lately that may have led to this happening to you.

[owlbill]

I have found nothing anywhere similar to holta, racing, hack, hacked, or the like. I am totally stumped. I had thought about loading fresh VB on our local test server and step by step loading up all our customization and mods to see if something there triggered this error.

The big bother for me is that on the original problem faq.php page, all the "reference" areas in the () marks are empty.

[King Kovifor]

Hm. I would say open a vB.com support ticket but they will probably pin it on a bad hack... Sadly enough.

I am at a complete loss on this problem.