Please help - Malicious code inserted into my forum!!

[xrayhead]

Still looking into this and still waiting for some advise!

This is a list of the actions performed by the plugin listed - Product: vBulletin





Here's a complete list of the plugins I have at present:

http://i38.photobucket.com/albums/e1...ps3a31cc3e.png



PS: Waiting for advice before I upgrade to 4.2.2

[semprot]

Still looking into this and still waiting for some advise!

This is a list of the actions performed by the plugin listed - Product: vBulletin





Here's a complete list of the plugins I have at present:

http://i38.photobucket.com/albums/e1...ps3a31cc3e.png



PS: Waiting for advice before I upgrade to 4.2.2

1. make sure all FTP, SSH, cpanel access has been secured (password changed) & main admin password has been changed to avoid direct file change / file upload to your forum.
2. Open your includes/config.php, add this somewhere after <?php

(for example on 10th line)

define('DISABLE_HOOKS', true); 

That will make sure all plugins will be disabled. Make sure the hacker doesn't have access to file edit so he won't edit your config.php to delete this line.

3. Do the rest, cleaning up malicious accounts, plugins, template edits.
4. Inspect all modified PHP files in your forum. admincp > diagnostic (i think) > suspect file version
5. do the first step once again.
6. when you are sure you are safe, delete line which was added on 2nd step.

[xrayhead]

Well I don't see any vBulletin staff helping out with this thread! I'm sure there are many other people in the same boat as me that had there site hacked.

I managed to get a security guy to have a look at the code that was inserted, is was encrypted but he managed to decrypt and look more it to what it was doing. After looking into it more it would seem I was more fortunate than others and the database was not compromised, however I still cant be 100% sure of this.

I have now removed ALL the files from the server and replaced with fresh one's, deleted the styles I had (lost all my hard work) and added new one's! This seems to have cleared the site up and Its now scanning as clean from mailware.

PS: I noticed I'm not getting any news post's in my ACP?

[Zachery]

Wayne went though in COMPLETE detail on how to fix the issue, did you not follow that? Does that not count as help? I'm confused

http://www.vbulletin.com/forum/forum...89#post4002489

[xrayhead]

Wayne went though in COMPLETE detail on how to fix the issue, did you not follow that? Does that not count as help? I'm confused

http://www.vbulletin.com/forum/forum...89#post4002489

And I'm VERY grateful for that!

QUESTIONS?

1. Before I deleted the plugin "Product : vBulletin" I took detailed screen captures and notes of the scripts that were run. Would it help if I added this information here?
It may benefit other user's with the same issue and also enable some investigation into what the attack was trying to do and also achieve!

2. Can I view a log of any database changes that were added by the hacker?
looking at the scripts I think I was lucky as the attack failed at some point and only my templates were changed, not sure about .php edits so I just deleted all of them and started again

3. "Restoring the default vBulletin files"

If I delete all my vBulletin files Version "4.1.5" on the server and upload "the latest stable version 4.2.2", then run the upgrade (Basically following the upgrade procedure) will this error or clear any database changes the hacker has done, or am I better to just re-upload and overwrite all the 4.1.5 files I have on there at present to see if that clears it?
I deleted ALL the vBulletin files on the server and copied back up the 4.1.5 files, removed my styles and re-installed them. I plan to upgrade to 4.2.2 this week.

Regards

Lee

[Zachery]

1. Not really.
2. Not unless your webhost has binary logging on, and that is very unlikely.
3. It will update the site, but it will not explicitly remove malicious things he has done. Though you should still upgrade. you still need to do the rest of the cleanup steps.

[Mattwhf]

xrayhead you can try Mod_Security Rules from Malware.Expert and install it on WHM/cPanel, Plesk or Directadmin here https://forumweb.hosting/marketplace...ty-rules.1620/ to protect your forum from malware and viruses.

Hope it helps!

[Mark.B]

This thread is almost five years old....no real benefit in bumping it now.