Have I Been Hacked?

[Scott Spain]

I keep getting message through my contact form from "Britney", "Bush", and a few others. Most of them look something like this:

The following message was sent to you via the Marketing Research Roundtable  Contact Us form by Britney.

--------------------------------

<a  href="http://scuko.milan.jp/Levaquin.html">Levaquin</a>;  http://scuko.milan.jp/Levaquin.html]Levaquin[/URL]  <a href="http://scuko.milan.jp/Amlodipine.html">Amlodipine</a>;  http://scuko.milan.jp/Amlodipine.html]Amlodipine[/URL]  <a href="http://scuko.milan.jp/Tamoxifen.html">Tamoxifen</a>;  http://scuko.milan.jp/Tamoxifen.html]Tamoxifen[/URL]  <a href="http://scuko.milan.jp/Nolvadex.html">Nolvadex</a>;  http://scuko.milan.jp/Nolvadex.html]Nolvadex[/URL]  <a href="http://scuko.milan.jp/Imitrex.html">Imitrex</a>;  http://scuko.milan.jp/Imitrex.html]Imitrex[/URL]  <a href="http://scuko.milan.jp/Glucopage.html">Glucopage</a>;  http://scuko.milan.jp/Glucopage.html]Glucopage[/URL]  <a href="http://scuko.milan.jp/Evista.html">Evista</a>;  http://scuko.milan.jp/Evista.html]Evista[/URL]  <a href="http://scuko.milan.jp/Claritin.html">Claritin</a>;  http://scuko.milan.jp/Claritin.html]Claritin[/URL]  <a href="http://scuko.milan.jp/Celecoxib.html">Celecoxib</a>;  http://scuko.milan.jp/Celecoxib.html]Celecoxib[/URL]  <a href="http://scuko.milan.jp/Busporine.html">Busporine</a>;  http://scuko.milan.jp/Busporine.html]Busporine[/URL]  <a href="http://scuko.milan.jp/Nexium.html">Nexium</a>;  http://scuko.milan.jp/Nexium.html]Nexium[/URL]  <a href="http://scuko.milan.jp/Lipitor.html">Lipitor</a>;  http://scuko.milan.jp/Lipitor.html]Lipitor[/URL]  <a href="http://scuko.milan.jp/Zocor.html">Zocor</a>; http://scuko.milan.jp/Zocor.html]Zocor[/URL]  <a href="http://scuko.milan.jp/Buspar.html">Buspar</a>;  http://scuko.milan.jp/Buspar.html]Buspar[/URL]  <a href="http://scuko.milan.jp/Zoloft.html">Zoloft</a>;  http://scuko.milan.jp/Zoloft.html]Zoloft[/URL]  <a href="http://scuko.milan.jp/Prozac.html">Prozac</a>;  http://scuko.milan.jp/Prozac.html]Prozac[/URL]  <a href="http://scuko.milan.jp/Celebrex.html">Celebrex</a>;  http://scuko.milan.jp/Celebrex.html]Celebrex[/URL]  <a href="http://scuko.milan.jp/Paxil.html">Paxil</a>; http://scuko.milan.jp/Paxil.html]Paxil[/URL]

--------------------------------

Referring  Page: http://dens.blox.pl/resource/Ambien.html
IP  Address: 85.255.117.18
User Name: Unregistered
User ID: 0

I suspect I've been hacked, and somebody is spamming through my board. I was pretty slow to upgrade from 3.4.0 to 3.5.0.

Any thoughts?

I'll edit this message to delete the URLs once I get this resolved.

Thanks.

[DelphiVillage]

set the "verify image" option on the sendmessage.php to yes and that's over unless they are using some kind of thrick but i wouldn't say this is a hack

goto admincp => vbulletin options site url contact us options =>allow guests to contact us (choose yes but verify image)

if you do not see an image there then there is something wrong with the image processing library you use (gd or ImageMagick)

[Wayne Luke]

As DelphiVillage said, turn on image verification on the contact us form when used by guests. Looks like simple spamming to me, nothing to indicate any kind of hacking.

[Scott Spain]

It is turned on, but doesn't appear to be functioning:

http://forum.researchinfo.com/sendmessage.php

In the AdminCP, I have "Yes, but verify image" selected, and I do see the vbulletin image in the AdminCP.

Any ideas?

Thanks.

[Wayne Luke]

Revert that template to see if that fixes it.

[Scott Spain]

I will. But before I do that, can you tell me what that will do to my theme? It was built from a copy of the default style. Will it switch it back to the default VB look? I've never reverted, and just want to know what to expect.

Thanks.

[Wayne Luke]

You just have to revert that one template. It will not change your colors or any other templates in the system.

[Scott Spain]

Okay, I thought I knew how to do this, but I guess not.

From the Style Manager, I selected "Revert All Templates" in the dropdown menu that appears next to my active style, and it came back with "Nothing to do".

[Wayne Luke]

You'll have to open a support ticket with FTP and Admin access so we can see why the image is not showing up then.