Myfilestore.com Virus

[oguzdinc]

Hello i have problem with my www.Madenciyim.com

Visitors coming from google search is redirecting to www.myfilestore.com. When they go back to google and come back again going to my website.

What can i do.

I deleted VBSEO plug in. I upgraded my vbulletin on friday but it is still happening.

[z3r0]

Check through your plugins for any new ones that may of been added, I've seen them on the global_complete hook location in the past for myfilestore.

[oguzdinc]

i contact with vb support and they offered me to delete "ech" files from plugin management. i hope problem is solved.

[mscottralston]

Good morning,

Over the weekend, I'm having reports of this exact same virus on my forums as well. Please help! (Should I have made my own thread for this?)

Thanks!!

[MarkFL]

Originally Posted by mscottralston

Good morning,

Over the weekend, I'm having reports of this exact same virus on my forums as well. Please help! (Should I have made my own thread for this?)

Thanks!!

Posting in this thread is fine, since it refers to the same issue that is the thread topic.

Did you try the suggestion in post #3?

[mscottralston]

I'm struggling to find the location of the 'ech' files. Could you direct me to the plugin folder in a typical VB4 installation?

Thanks!

[MarkFL]

Originally Posted by mscottralston

I'm struggling to find the location of the 'ech' files. Could you direct me to the plugin folder in a typical VB4 installation?

Thanks!

I suspect that what you want to do is go to the "Plugin Manager" in your AdminCP and look for the suspect plugins there.

[mscottralston]

The problem is that I inherited these forums from someone else -- I don't have a clear sense of which plugins should and shouldn't be in there, nor do I see timestamps on them to be able to pick one out of the lineup because it's recently installed. Certainly I haven't taken any actions to recently install a plugin; the only thing I've done is uninstall forumrunner (and delete its folder on the server).

I'm just going to paste the lot and hope someone has insight into one-of-these-things-is-not-like-the-others:

Plugin System
Title Hook Location Active Controls
Product : vBulletin
Federal ajax_complete [Edit] [Delete]
Federal ajax_complete [Edit] [Delete]
global_rewrite global_start [Edit] [Delete]
login_rewrite login_process [Edit] [Delete]
Product : Censor Replacements
censor_replacing_script bbcode_parse_start [Edit] [Delete]
Product : GlowHost - Spam-O-Matic
Affiliate link placement parse_templates [Edit] [Delete]
Form actions inlinemod_action_switch [Edit] [Delete]
GlowHost - Spam-O-Matic: Activation Post-Fix register_activate_process [Edit] [Delete]
GlowHost - Spam-O-Matic: AKISMET SPAM filter newpost_process [Edit] [Delete]
GlowHost - Spam-O-Matic: Finish Registration register_addmember_complete [Edit] [Delete]
GlowHost - Spam-O-Matic: First Post/Thread Control threadfpdata_presave [Edit] [Delete]
GlowHost - Spam-O-Matic: Modify User Quick Links Menu useradmin_edit_start [Edit] [Delete]
GlowHost - Spam-O-Matic: Registration Pre-Check register_addmember_process [Edit] [Delete]
GlowHost - Spam-O-Matic: Replies Control postdata_presave [Edit] [Delete]
Menu item in Moderation Tools showthread_start [Edit] [Delete]
Stats render forumhome_complete [Edit] [Delete]
Product : HS - External Signature Image Size Limiter
HS - External Signature Image Size Limiter profile_updatesignature_start [Edit] [Delete]
Product : PostRelease
Cache cache_templates [Edit] [Delete]
Template Page misc_start [Edit] [Delete]
Thread List Page forumdisplay_complete [Edit] [Delete]
Product : Skimlinks Plugin
Add Skimlinks Classes to PostBit postbit_display_complete [Edit] [Delete]
Add Skimlinks JavaScript to footer template showthread_complete [Edit] [Delete]
Add Skimlinks Option to Edit Options Form profile_editoptions_start [Edit] [Delete]
Extend User DataManager userdata_start [Edit] [Delete]
Update Skimlinks Preference profile_updateoptions [Edit] [Delete]
Product : Stop the Registration Bots
Add Member: Check form submit time, hash, and random hidden field. register_addmember_process [Edit] [Delete]
Reg Check Date: Check for hash and random hidden field passed. Second Step register_checkdate [Edit] [Delete]
Register Start: Load Functions. First Step. register_start [Edit] [Delete]
Product : Yet Another Award System 4.0
Awards WOL process online_location_process [Edit] [Delete]
Awards WOL unknown online_location_unknown [Edit] [Delete]
CSS - Inject CSS into vBulletin css_start [Edit] [Delete]
YAAS - Add Tab to Navbar process_templates_complete [Edit] [Delete]
YAAS - Cache Templates cache_templates [Edit] [Delete]
YAAS - Give Award to User Nav mod_index_navigation [Edit] [Delete]
YAAS - Member List Display memberlist_bit [Edit] [Delete]
YAAS - Tab set user member_start [Edit] [Delete]
YAAS in Member Profile - Init init_startup [Edit] [Delete]
YAAS in Member Profile - Profile member_build_blocks_start [Edit] [Delete]
YAAS in Posbit postbit_display_complete [Edit] [Delete]
YAAS Template Group template_groups [Edit] [Delete]
Save Active Status

Thanks again for your help!

[MarkFL]

I would focus on these:

Product : vBulletin
Federal ajax_complete [Edit] [Delete]
Federal ajax_complete [Edit] [Delete]
global_rewrite global_start [Edit] [Delete]
login_rewrite login_process [Edit] [Delete]

Particularly the last two. Try disabling those two and see what happens.

[mscottralston]

Thanks, I have done so!