[Forum] Templates have been infected - how to troubleshoot?

[ascender]

I'm running a 4.0.2 PL1 forum. There's a malicious redirect to 176.9.179.140.

Thanks to the other troubleshooting posts on this forum it would appear that the code for these redirects is in my templates. Is there an easy way to replace the contents of the templates with default versions as I know they're held within the SQL database rather than as actual physical files on the server.

Thanks,


Mike.

[beishe8]

I would make a full backup (files and database).
Download vB 4.x.
Upload it to the server.
Upgrade.
Revert the templates.

[borbole]

Have a look at this mod:

http://www.vbulletin.org/forum/showthread.php?t=281080

There are also a lot of threads on the subject. A little search should reveal a lot of tips on how to clean up the infected forum.

It would also be best to upgrade your forum to the latest version. You are running an older version that contains several known security issues, not to mention the bugs.

[ascender]

I guess the problem with vBulletin is that it lets users like me with some techie knowledge but not web-specific knowledge, get up and running quickly. But when things go wrong, I'm out of my depth.

I signed up with Sucuri this morning and they cleaned my site up within a few hours. I can't recommend their service highly enough, it was an amazingly quick turnaround and their helpdesk guys were very helpful.