Cannot Setup Paid Subscriptions

[ForceHSS]

Originally Posted by ozzy47

As I asked in post #13

Yes but that was after I made the post. Enough said this get back to helping the op

[plumwd]

How can I determine if the installation has been compromised by hackers?

--------------- Added [DATE]1413478591[/DATE] at [TIME]1413478591[/TIME] ---------------

What else does disabling the hooks turn off? Is it more than just plugins? I have combed through all the plugins in this board and no luck. The subscriptions are only available if I disable via the config.

[Lynne]

Originally Posted by plumwd

How can I determine if the installation has been compromised by hackers?

--------------- Added [DATE]1413478591[/DATE] at [TIME]1413478591[/TIME] ---------------

What else does disabling the hooks turn off? Is it more than just plugins? I have combed through all the plugins in this board and no luck. The subscriptions are only available if I disable via the config.

I told you what to do here:

Originally Posted by Lynne

Anyway.... you've already tried disabling the products and that didn't fix it. My guess is the hackers created a single plugin that will show up in your Plugin Manager.

You need to go to Plugins & Products > Plugin Manager, not Manage Plugins. Look at the plugins listed at the very top under the heading "vbulletin". Those are single plugins that won't be disabled when you disable your products.

[plumwd]

Thanks! I assumed that Manage Plugins and Plugin Manager were the same thing. Just looked and found some encrypted code that is probably the culprit.

[ForceHSS]

Originally Posted by plumwd

Thanks! I assumed that Manage Plugins and Plugin Manager were the same thing. Just looked and found some encrypted code that is probably the culprit.

Can you show a screenshot of it

[plumwd]

I deleted it from vbulletin, but in the Plugin Manager is was listed as VBulletin.

I do have a copy of the code, it also existed as a file named zasdfe.php.

When I unencrypted it, it showed it as a backdoor called FilesMan.

[Black Snow]

Originally Posted by plumwd

I deleted it from vbulletin, but in the Plugin Manager is was listed as VBulletin.

I do have a copy of the code, it also existed as a file named zasdfe.php.

When I unencrypted it, it showed it as a backdoor called FilesMan.

I had this on an old install. did it look like this?

http://pastebin.com/pQAkDrY1

[ozzy47]

Originally Posted by plumwd

I deleted it from vbulletin, but in the Plugin Manager is was listed as VBulletin.

I do have a copy of the code, it also existed as a file named zasdfe.php.

When I unencrypted it, it showed it as a backdoor called FilesMan.

That is what I asked in post #13, but it seems it was overlooked.

Now you need to clean up the site.

Please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked
http://www.vbulletin.com/forum/blogs...vbulletin-site