Announcement

Collapse
No announcement yet.

My Vbulletin is infected with a Trojan Horse?

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • beishe8
    replied
    Originally posted by kvk007 View Post
    We deleted all the files. We re-uploaded files which were more than 8 months old. But the trojan is back!

    I did virus-scan from CPeanl;

    public_html/forum/modules/.htaccess Trojan.JS.Redirector
    public_html/forum/modules/ufukowi/h/.htaccess Trojan.JS.Redirector

    How is it that possible?
    The files are already infected on your computer.
    Deleting them from the server and uploading them from another computer would help.

    #1 Download the vB zip file to another computer.
    #2 Unzip and edit
    #3 Upload them to the server.
    (Delete and recreate the database as well)
    #4 Install

    Leave a comment:


  • Steve Machol
    replied
    It's possible if it's a false positive as I already explained.

    Leave a comment:


  • kvk007
    replied
    We deleted all the files. We re-uploaded files which were more than 8 months old. But the trojan is back!

    I did virus-scan from CPeanl;

    public_html/forum/modules/.htaccess Trojan.JS.Redirector
    public_html/forum/modules/ufukowi/h/.htaccess Trojan.JS.Redirector

    How is it that possible?

    Leave a comment:


  • Steve Machol
    replied
    That means that you no longer have a web site. I'm not sure it was ever established tht you had a trojan.

    I suggest reuploading the original vB files, then if you get the same results it's almost certainly a false positive, i.e., the program is reporting a trojan when there is none.

    Leave a comment:


  • kvk007
    replied
    Please some help.

    I've removed all the files found under public_html. Does that mean that I am trojan-free?

    Do I need to do anything else? Please advice.

    Leave a comment:


  • beishe8
    replied
    Originally posted by kvk007 View Post
    What's a false positive? Can you please bare with me, and try to explain it in plain english?
    When a file is not really harmful.

    Leave a comment:


  • kvk007
    replied
    What's a false positive? Can you please bare with me, and try to explain it in plain english?

    Leave a comment:


  • Steve Machol
    replied
    Assuming this is not a false positive and you truly are infected, then someone did this via access to yuor server or your hosting account.

    Leave a comment:


  • kvk007
    replied
    Do you know how such site can be infected like that?

    And, is the database infected?

    Leave a comment:


  • Steve Machol
    replied
    Your server is infected. Remove the trojan files and contact your host.

    Leave a comment:


  • Dr Diablo
    started a topic My Vbulletin is infected with a Trojan Horse?

    My Vbulletin is infected with a Trojan Horse?

    I hope i posted this in the the correct forum. I kinda need help here, my forum (omanserv.com/forum) recently got hacked i guess and now opening the index.php of the forum pops up my antivirus n tells me that a trojan horse has been found and shows me the url of a different file everytime, they all are located in the clientscript folder though.. Any idea how can i fix this?

    Here is a log i got from support

    PHP Code:
    public_html/omanserv.css        Trojan.JS-1
    public_html
    /.htaccess   Trojan.JS.Redirector
    public_html
    /tut.js      Trojan.JS-1
    public_html
    /oscss.css   Trojan.JS-1
    public_html
    /forum/cpstyles/vBulletin_3_Default/controlpanel.css Trojan.JS-1
    public_html
    /forum/cpstyles/vBulletin_2_Default/controlpanel.css Trojan.JS-1
    public_html
    /forum/cpstyles/vBulletin_3_Silver/controlpanel.css  Trojan.JS-1
    public_html
    /forum/cpstyles/vBulletin_3_Frontend/controlpanel.css        Trojan.JS-1
    public_html
    /forum/cpstyles/vBulletin_3_Manual/controlpanel.css  Trojan.JS-1
    public_html
    /forum/archive/archive.css   Trojan.JS-1
    public_html
    /forum/clientscript/vbulletin_cpoptions_scripts.js   Trojan.JS-1
    ...
    ... 
    Would really appreciate your help, thanks!

Related Topics

Collapse

Working...
X