[Forum] Many Database Errors After Malicious Attack on Server

[yo!ijob]

Hi there,

I was unfortunately attacked by some malicious code somehow. I have attamepted to clean up the server but am left with many databases.

When I browse a particular subforum I receive this error

Database error in vBulletin 4.1.12:

Invalid SQL:

SELECT
IF(votenum >= 1, votenum, 0) AS votenum,
IF(votenum >= 1 AND votenum > 0, votetotal / votenum, 0) AS voteavg,
post.pagetext AS preview,
thread.threadid, thread.title AS threadtitle, thread.forumid, thread.pollid, thread.open, thread.postusername, thread.postuserid, thread.iconid AS threadiconid,
thread.dateline, thread.notes, thread.visible, thread.sticky, thread.votetotal, thread.attach, thread.lastpost, thread.lastposter, thread.lastposterid, thread.lastpostid, thread.replycount, IF(thread.views<=thread.replycount, thread.replycount+1, thread.views) AS views,
thread.prefixid, thread.taglist, thread.hiddencount, thread.deletedcount,
user.usergroupid, user.homepage, user.options AS useroptions, IF(userlist.friend = 'yes', 1, 0) AS isfriend,
user.lastactivity, user.lastvisit, IF(user.options & 512, 1, 0) AS invisible

, deletionlog.userid AS del_userid, deletionlog.username AS del_username, deletionlog.reason AS del_reason
, threadread.readtime AS threadread
, threadredirect.expires

FROM yo_thread AS thread
LEFT JOIN yo_user AS user ON (user.userid = thread.lastposterid)
LEFT JOIN yo_userlist AS userlist ON (userlist.relationid = user.userid AND userlist.type = 'buddy' AND userlist.userid = 1)
LEFT JOIN yo_deletionlog AS deletionlog ON(thread.threadid = deletionlog.primaryid AND deletionlog.type = 'thread')

LEFT JOIN yo_threadread AS threadread ON (threadread.threadid = thread.threadid AND threadread.userid = 1)
LEFT JOIN yo_post AS post ON(post.postid = thread.firstpostid)

LEFT JOIN yo_threadredirect AS threadredirect ON(thread.open = 10 AND thread.threadid = threadredirect.threadid)

WHERE thread.threadid IN (0,73387,73388,73369,73370,73371,73372,73373,73374,73375,73376,73377,73378,73379,73380,733 81,73382,73383,73384,73385,73386)
ORDER BY thread.sticky DESC, lastpost DESC;

MySQL Error : Table './db312356384/yo_post' is marked as crashed and last (automatic?) repair failed
Error Number : 144
Request Date : Tuesday, May 15th 2012 @ 07:33:47 AM
Error Date : Tuesday, May 15th 2012 @ 07:33:49 AM
Script : http://www.yoliverpool.com/forum/for...pool-Echo-News
Referrer : http://www.yoliverpool.com/forum/forum.php
IP Address : 109.149.5.153
Username : Kev
Classname : vB_Database
MySQL Version : 5.0.92-1~ui40+1

and if I try and get into the admin area, I received this

Database error in vBulletin 4.1.12:

Invalid SQL:
SELECT COUNT(*) AS count FROM yo_post WHERE dateline >= 1337032800;

MySQL Error : Table './db312356384/yo_post' is marked as crashed and last (automatic?) repair failed
Error Number : 144
Request Date : Tuesday, May 15th 2012 @ 07:38:28 AM
Error Date : Tuesday, May 15th 2012 @ 07:38:30 AM
Script : http://www.yoliverpool.com/forum/adm...ex.php?do=home
Referrer : http://www.yoliverpool.com/forum/admincp/index.php
IP Address : 109.149.5.153
Username : Kev
Classname : vB_Database
MySQL Version : 5.0.92-1~ui40+1

[Trevor Hannant]

Run Repair/Optimize in the Admin CP. You may need to run it more than once to fix all errors:

Admin Control Panel -> Maintenance -> Repair/Optimize Tables -> Check All -> Continue

If you cannot access the Admin CP, then you can use phpMyAdmin to repair tables.

If that doesn't work then this may be too damaged to fix with the normal methods. Please check out this thread for other ways to repair a db, particularly items #2 and 3:

https://www.vbulletin.com/forum/show...threadid=44909

You may have to ask your host to try and repair this for you.

[yo!ijob]

Hi trevor.

Cheers for the reply. I have tried to do that via the cp panel and phpmyadmin, both didn't complete the process, they just hung for a long time. I will look at the link at feedback later.

Kev

[yo!ijob]

Update,

I have just looked at my database and 3 tables dont seem to be looking correct:

yo_blog_aggregate_tempdc_1337043600

unknown

MEMORY

latin1_swedish_ci

unknown

-

yo_cpsession

unknown

MEMORY

latin1_swedish_ci

unknown

-

yo_session

unknown

MEMORY

latin1_swedish_ci

unknown

-

I cant do anything with them, unknown is the size

[yo!ijob]

Errors from those tables:

SQL query:
SHOW FULL FIELDS FROM `yo_session` ;



MySQL said:
#1030 - Got error 28 from storage engine

[borbole]

Errors from those tables:

That error occurrs when MySQL doesn't have any free hard disk space to write to. You will need to talk to your host about it.

In meanwhile you can try to delete both session tables and then recreate them again and see if that would help. Also the yo_blog_aggregate_tempdc_1337043600 table can be deleted as well.

The code to recreate those tables can be found in the mysql-schema.php file inside the /install/ folder.

[yo!ijob]

Thanks for the reply, I will contact my host again.

Can someone give me the exact code to create the 3 tables above with the prefix yo_

Many thanks

[TheLastSuperman]

Thanks for the reply, I will contact my host again.

Can someone give me the exact code to create the 3 tables above with the prefix yo_

Many thanks

Wait for your host to reply first, it seems initially your post table was crashed so after they sort the disk space issue simply repair/optimize the post table as Trevor mentioned to see if it's sorted then. You can also delete the aggregate temp table as Borbole suggested however note the # on the end i.e. 1337043600 you can convert that here to a timestamp - http://www.epochconverter.com/ now check your servers error logs to see what happened right around that time before you simply dismiss/delete the junk table.

[yo!ijob]

Hi Many thanks,

I have already deleted the 3 tables above ;(

[TheLastSuperman]

Hi Many thanks,

I have already deleted the 3 tables above ;(

Don't be so hasty next time here is the SQL to re-create those tables assuming your engine type is myisam:

CREATE TABLE " . TABLE_PREFIX . "cpsession (
    userid INT UNSIGNED NOT NULL DEFAULT '0',
    hash VARCHAR(32) NOT NULL DEFAULT '',
    dateline INT UNSIGNED NOT NULL DEFAULT '0',
    PRIMARY KEY (userid, hash)
)    ENGINE = MyISAM

CREATE TABLE " . TABLE_PREFIX . "session (
    sessionhash CHAR(32) NOT NULL DEFAULT '',
    userid INT UNSIGNED NOT NULL DEFAULT '0',
    host CHAR(15) NOT NULL DEFAULT '',
    idhash CHAR(32) NOT NULL DEFAULT '',
    lastactivity INT UNSIGNED NOT NULL DEFAULT '0',
    location CHAR(255) NOT NULL DEFAULT '',
    useragent CHAR(100) NOT NULL DEFAULT '',
    styleid SMALLINT UNSIGNED NOT NULL DEFAULT '0',
    languageid SMALLINT UNSIGNED NOT NULL DEFAULT '0',
    loggedin SMALLINT UNSIGNED NOT NULL DEFAULT '0',
    inforum SMALLINT UNSIGNED NOT NULL DEFAULT '0',
    inthread INT UNSIGNED NOT NULL DEFAULT '0',
    incalendar SMALLINT UNSIGNED NOT NULL DEFAULT '0',
    badlocation SMALLINT UNSIGNED NOT NULL DEFAULT '0',
    bypass TINYINT NOT NULL DEFAULT '0',
    profileupdate SMALLINT UNSIGNED NOT NULL DEFAULT '0',
    apiclientid INT UNSIGNED NOT NULL DEFAULT '0',
    apiaccesstoken VARCHAR(32) NOT NULL DEFAULT '',
    isbot TINYINT NOT NULL DEFAULT '0',
    PRIMARY KEY (sessionhash),
    KEY last_activity USING BTREE (lastactivity),
    KEY user_activity USING BTREE (userid, lastactivity),
    KEY guest_lookup (idhash, host, userid),
    KEY apiaccesstoken (apiaccesstoken)
)    ENGINE = MyISAM

Replace " . TABLE_PREFIX . " with your table prefix if you have one otherwise remove that code fromt he two codes above entirely. *Example if you have a table prefix vb_ then it would read:

CREATE TABLE vb_cpsession (
    userid INT UNSIGNED NOT NULL DEFAULT '0',
    hash VARCHAR(32) NOT NULL DEFAULT '',
    dateline INT UNSIGNED NOT NULL DEFAULT '0',
    PRIMARY KEY (userid, hash)
)    ENGINE = MyISAM

[yo!ijob]

Many thanks, its a Mysql database, your help is appreciated, the above gave errors

[borbole]

Many thanks, its a Mysql database, your help is appreciated, the above gave errors

Did you replace the prefix with that of your forum 's database as adviced above before running the queries?

[yo!ijob]

No i didn't, i have now, many thanks. I will report back with any progress