my 3.6.8 has been defaced - perhaps a known exploit

stardotstar

Member

Join Date: Feb 2007
Posts: 83

my 3.6.8 has been defaced - perhaps a known exploit

Tue 18th Nov '08, 4:59pm

I know that I should have upgraded but currently the new site I am migrating to is occupying my time and I may have been caught out by a known exploit.

If anyone can help me identify the exploit I would appreciate it.

Ok here goes. the site has been up a couple of years and had no defacing or cracks until now.

It seems that somehow they have injected code into the headers but I can't find it in the database or by grepping the www tree:

Code:

<body><div style="position:absolute;left:-74402px;top:-56110px"></div><!--411533304--><h1>tiger cruise disney cast</h1><a href="http://davidkrumholtz.lybur.com/gallery/?show-info=638">tiger cruise disney cast</a><br><!--508443238--><h1>walt disney world resort vacations packages</h1><a href="http://ittybittyscrapshack.com/?show-page=650">walt disney world resort vacations packages</a><br><!--1017517207--><h1>carta organisasi hotel hilton kuala lumpur</h1><a href="http://www.badac.org.uk/wp/?item-help=643">carta organisasi hotel hilton kuala lumpur</a><br><!--866920950--><h1>doubletree hotels chicago north shore</h1><a href="http://forum.solihullsociety.org/?show-info=661">doubletree hotels chicago north shore</a><br><!--921571920--><h1>blues traveler lyrics all for you</h1><a href="http://www.schnappschuss-galerie.de/?info=662">blues traveler lyrics all for you</a><br><!--324863470--><h1>sheraton hotels resorts miami</h1><a href="http://www.pressphoto.be/gallery/?show-item=603">sheraton hotels resorts miami</a><br><!--231404004--><h1>discount airfares cheap tickets</h1><a href="http://photos.pilpot.net/?help=620">discount airfares cheap tickets</a><br><!--967095844--><h1>find cheap hotels in new york</h1><a href="http://iccec-europe.org/gallery/?info=615">find cheap hotels in new york</a><br><!--63035979--><h1>beach resorts sandals</h1><a href="http://www.paraglidingforum.lv/?help-page=622">beach resorts sandals</a><br><!--433349170--><h1>hilton hotels employment</h1><a href="http://www.augenzeuge.net/cpg/?take=656">hilton hotels employment</a><br><!--886622013--><h1>cheap hotels london england uk</h1><a href="http://soarnc.org/gallery/?info=626">cheap hotels london england uk</a><br><!--124587886--><h1>travel inn hotels london</h1><a href="http://www.langleyukes.com/photogallery/index.php/?show-help=626">travel inn hotels london</a><br><!--1006757682--><h1>enterprise rent car discount coupons</h1><a href="http://www.rhinopm.com/?get-page=616">enterprise rent car discount coupons</a><br><!--36062961--><h1>carnival cruises costa maya</h1><a href="http://www.fcarges.net/album_foto/?item-page=684">carnival cruises costa maya</a><br><!--1121550690--><h1>grand princess cruise ship tilt</h1><a href="http://www.wowphilippinestravelagency.com/pictures/?show-info=624">grand princess cruise ship tilt</a><br><!--884878228--><h1>2003 marriott hotel bombing</h1><a href="http://www.dreamlake-fishing.com/fishing-photos/?look=634">2003 marriott hotel bombing</a><br><!--371426244--><h1>jw marriott hotel hong kong lobby lounge</h1><a href="http://ontfin.com/?take=608">jw marriott hotel hong kong lobby lounge</a><br><!--158795757--><h1>park hyatt hotels sydney</h1><a href="http://gallery.stealthturtle.com/?get-id=620">park hyatt hotels sydney</a><br><!--898197778--><h1>hotel doubletree philadelphia</h1><a href="http://www.furrfu.org/gallery/?best=648">hotel doubletree philadelphia</a><br><!--322563157--><h1>disney cruise reviews 2004</h1><a href="http://www.osk-art.cz/gallery/?show-help=658">disney cruise reviews 2004</a><br><!--246615747--><h1>traveling to canada us customs</h1><a href="http://www.ecoledelapaix.org/coppermine/?item-page=644">traveling to canada us customs</a><br><!--3710181--><h1>costa lines cruises</h1><a href="http://gallery.spotter-cgn.de/?show-page=627">costa lines cruises</a><br><!--786447119--><h1>business traveler magazine</h1><a href="http://www.bruisedfruitcds.com/list/?item-help=635">business traveler magazine</a><br><!--983123827--><h1>moon palace resorts cancun hurricane wilma</h1><a href="http://burschenschaft.werdorf.com/?show-item=641">moon palace resorts cancun hurricane wilma</a><br><!--898271982--><h1>travelling light theatre company</h1><a href="http://www.lunaparknet.com/?show-page=625">travelling light theatre company</a><br><!--596597145--><h1>newest princess cruise line ships</h1><a href="http://www.threecranes.org/calendars/?info-id=898">newest princess cruise line ships</a><br><!--748306456--><h1>spa resorts bintan</h1><a href="http://www.spy-caps.com/gallery/?item-id=628">spa resorts bintan</a><br><!--1156908717--><h1>airfare discount tickets for students</h1><a href="http://sacloaves.org/?best=679">airfare discount tickets for students</a><br><!--768712453--><h1>budget resorts boracay</h1><a href="http://www.zero4.de/cpg/?look=649">budget resorts boracay</a><br><!--1139619272--><h1>airplane tickets cheap airfare</h1><a href="http://webbedpause.com/bigdhrcmb/?page-about=638">airplane tickets cheap airfare</a><br><!--137907437--><h1>discount royal caribbean cruises strong</h1><a href="http://pictures.bivens.ca/?get-info=640">discount royal caribbean cruises strong</a><br><!--957894595--><h1>royal caribbean cruise line jobs in florida</h1><a href="http://www.babesnguitars.com/?page-about=658">royal caribbean cruise line jobs in florida</a><br><!--123882951--><h1>atlantis resort nassau bahamas address</h1><a href="http://www.go-spf.at/joomla/?item-page=604">atlantis resort nassau bahamas address</a><br><!--227063092--><h1>easy travels agency</h1><a href="http://www.wnycomsoc.org/community/?show-id=624">easy travels agency</a><br><!--133009997--><h1>american express travelers cheques scams</h1><a href="http://www.bogenschuetzen-feucht.de/coppermine/?best=617">american express travelers cheques scams</a><br><!--1107934324--><h1>expedia travel deals las vegas</h1><a href="http://www.zhanggy.com/?show-info=600">expedia travel deals las vegas</a><br><!--1053357558--><h1>princess line cruises alaska</h1><a href="http://stephanebelin.com/?show-page=630">princess line cruises alaska</a><br><!--708347804--><h1>cheap hawaii airfare deals</h1><a href="http://www.optimists-alumni.org/photos/?page-id=628">cheap hawaii airfare deals</a><br><!--87745786--><h1>aces traveling nursing agency</h1><a href="http://www.quilt-ez.com/?show-item=608">aces traveling nursing agency</a><br><!--505252482--><h1>cruise ships carnival spirit</h1><a href="http://www.archeli.com.au/?item-info=634">cruise ships carnival spirit</a><br><!--175825489--><h1>dollar rent cars los angeles</h1><a href="http://www.montgomerycountymonitor.com/?page-id=664">dollar rent cars los angeles</a><br><!--1177759936--><h1>list of traveling carnivals in the united states</h1><a href="http://www.royalbullmastiffs.net/photos/?help-page=623">list of traveling carnivals in the united states</a><br><!--1179874739--><h1>all inclusive florida resorts vacations mexico</h1><a href="http://ez2mail.com/cancionesphotos/?get-help=654">all inclusive florida resorts vacations mexico</a><br><!--1087454124--><h1>travelers insurance group auto</h1><a href="http://www.clubdefi.ca/?page-about=644">travelers insurance group auto</a><br><!--796613016--><h1>china hong kong travel agency</h1><a href="http://arjunrampalonline.com/gallery/?best=644">china hong kong travel agency</a><br><!--837462111--><h1>last minute cheap flights to florida</h1><a href="http://www.quadrupedaljellybean.com/gallery148/?pq=599">last minute cheap flights to florida</a><br><!--332024120--><h1>tom cruise baby pictures suri</h1><a href="http://www.markbautista.com/forum/?look=612">tom cruise baby pictures suri</a><br><!--537011634--><h1>cheap carnival cruises iv</h1><a href="http://taurus.galacgallery.com/mileygallery/?info-id=614">cheap carnival cruises iv</a><br><!--750161546--><h1>met life travelers insurance</h1><a href="http://www.mabcr.org/?help=625">met life travelers insurance</a><br><!--713245243--><h1>fairfield resorts hawaii waikiki</h1><a href="http://folk.ntnu.no/magnusrk/wiki/?take=612">fairfield resorts hawaii waikiki</a><br><!--1153458248--><h1>marriot hotels jobs</h1><a href="http://gallery.vicchi.org/?page-info=664">marriot hotels jobs</a><br><!--791530067--><h1>holiday inn hotels employment ohio</h1><a href="http://www.savecarsonbeckett.com/?help-about=650">holiday inn hotels employment ohio</a><br><!--910292969--><h1>cheap flights ryanair</h1><a href="http://tacora.facsae.uta.cl/~cihdexp/foto/?show-id=600">cheap flights ryanair</a><br><!--7271955--><h1>cheap airfares to india from australia</h1><a href="http://t-ono.net/?item-page=677">cheap airfares to india from australia</a><br><!--566804389--><h1>the arizona republic travel section</h1><a href="http://www.oddpla.net/realm/?take=621">the arizona republic travel section</a><br><!--749234001--><h1>premier lodge travel inn huddersfield</h1><a href="http://web.ait.tokushima-u.ac.jp/kita/album/index.php/?show-info=620">premier lodge travel inn huddersfield</a><br><!--327200884--><h1>hilton chicago hotel deals</h1><a href="http://floorballcanada.com/?item-page=623">hilton chicago hotel deals</a><br><!--961085351--><h1>galveston carnival cruise celebration</h1><a href="http://www.halloweenartexhibit.com/gallery/?show-help=624">galveston carnival cruise celebration</a><br><!--965574670--><h1>really cheap airline tickets airfare</h1><a href="http://smm.solidmodelmemories.net/Gallery/?item-help=660">really cheap airline tickets airfare</a><br><!--1131976299--><h1>air asia booking ticket domestic</h1><a href="http://africanvioletfun.com/AFDPhotos/?look=547">air asia booking ticket domestic</a><br><!--1090459371--><h1>find cheap airfare deals from</h1><a href="http://teammedics.com/dfxstats/?show-help=603">find cheap airfare deals from</a><br><!--345343670--><h1>resort quest kauai beach makawa</h1><a href="http://www.lotusconcept.com/cpg/?help-page=626">resort quest kauai beach makawa</a><br><!--488148547--><h1>travel agency host agent</h1><a href="http://justusmc.com/calendar/?item-info=628">travel agency host agent</a><br><!--837981537--><h1>cheapest airfares to las vegas</h1><a href="http://www.billysandifer.com/gallery/?info-id=649">cheapest airfares to las vegas</a><br><!--1034509837--><h1>tom cruise rumors rob thomas</h1><a href="http://88.198.75.242/wbb2/?page-about=633">tom cruise rumors rob thomas</a><br><!--401590018--><h1>atlanta to las vegas cheap airfare</h1><a href="http://www.hikarachi.com/?take=627">atlanta to las vegas cheap airfare</a><br><!--312285955--><h1>four points sheraton hotels illinois</h1><a href="http://www.livingdeadnightmareproductions.com/gallery/?get-help=638">four points sheraton hotels illinois</a><br><!--589102578--><h1>caribbean all inclusive resorts jamaica</h1><a href="http://www.ganggaisland.com/galleries/?item-help=638">caribbean all inclusive resorts jamaica</a><br><!--1033174172--><h1>sheraton hotel mexico city cuban</h1><a href="http://www.odonataforum.com/?show-page=692">sheraton hotel mexico city cuban</a><br><!--331987018--><h1>cheap last minute travel packages</h1><a href="http://www.schofieldfans.co.uk/?show-id=624">cheap last minute travel packages</a><br><!--1007870736--><h1>compare cheap airfare flights</h1><a href="http://www.gluetree.com/?help-about=651">compare cheap airfare flights</a><br><!--499316192--><h1>penembakan di hotel hilton jakarta</h1><a href="http://ibwt.info/?info-about=625">penembakan di hotel hilton jakarta</a><br><!--136645975--><h1>the hotel rwanda rusesabagina foundation</h1><a href="http://www.travelninja.com/gallery/?get-page=648">the hotel rwanda rusesabagina foundation</a><br><!--1162325582--><h1>raj tours and travels in london</h1><a href="http://kratornas.com/nv/?get-help=757">raj tours and travels in london</a><br><!--105406249--><h1>international health insurance travel</h1><a href="http://utahatv.com/?info-about=650">international health insurance travel</a><br><!--74723050--><h1>low budget london hotels</h1><a href="http://www.pi4raz.nl/?show-info=616">low budget london hotels</a><br><!--434499326--><h1>premier travel inns london</h1><a href="http://gallery.our-aquarium.ru/?item-help=611">premier travel inns london</a><br><!--879016141--><h1>new world hotel renaissance ho chi minh city</h1><a href="http://www.colegioarubano.aw/?help=671">new world hotel renaissance ho chi minh city</a><br><!--606280718--><h1>sandals resorts beaches</h1><a href="http://www.underwaterworld.uk.com/?item-info=643">sandals resorts beaches</a><br><!--645052112--><h1>habbo hotel singapore game cheats</h1><a href="http://kakanj.ba/gimnazija/?pq=636">habbo hotel singapore game cheats</a><br><!--976927824--><h1>hotel radisson bogota</h1><a href="http://937pets.com/gallery/?get-id=595">hotel radisson bogota</a><br><!--507849609--><h1>the sisterhood of traveling pants movie soundtrack</h1><a href="http://www.achintoommenthomas.net/photos/?get-help=651">the sisterhood of traveling pants movie soundtrack</a><br><!--40997502--><h1>nurses traveling lpn</h1><a href="http://www.fans-supreme.de/?help-about=615">nurses traveling lpn</a><br><!--500651857--><h1>carnival cruise line jobs available</h1><a href="http://crystalliuyifei.com/forum/?item-id=639">carnival cruise line jobs available</a><br><!--206248975--><h1>orlando hotels cheap on international drive</h1><a href="http://www.nepalaawaz.com/?get-item=640">orlando hotels cheap on international drive</a><br><!--466740801--><h1>cheap air tickets online canada</h1><a href="http://www.wolfkeeper.org/board/?info=623">cheap air tickets online canada</a><br><!--195192635--><h1>central african republic travel advisory</h1><a href="http://www.sassen.org/?info-id=608">central african republic travel advisory</a><br><!--971251247--><h1>travel lodge newcastle quayside</h1><a href="http://helihell.com/forumdisplay.php/?show-item=637">travel lodge newcastle quayside</a><br><!--819912954--><h1>cheapest airfares to london from australia</h1><a href="http://www.eliterides.com/?show-id=613">cheapest airfares to london from australia</a><br><!--565728437--><h1>radisson hotel manchester new hampshire</h1><a href="http://afanime.net/?about=245">radisson hotel manchester new hampshire</a><br><!--1030873860--><h1>lpn traveling nurses hospital</h1><a href="http://www.thejunctionbar.com/calendar/download.php/?get-help=659">lpn traveling nurses hospital</a><br><!--347198761--><h1>triple aaa travel rollover</h1><a href="http://www.ftisungard.com/?show-id=625">triple aaa travel rollover</a><br><!--44485073--><h1>ryanair cheap flights to ireland</h1><a href="http://www.animesydney.org/?page-about=639">ryanair cheap flights to ireland</a><br><!--6975140--><h1>stouffer renaissance austin hotel</h1><a href="http://www.dementiaclothing.com/?get-id=622">stouffer renaissance austin hotel</a><br><!--686420633--><h1>best western hotels chicago grant park</h1><a href="http://photo.tsubaya.com/album/?info-id=640">best western hotels chicago grant park</a><br><!--1173975551--><h1>diamond princess cruise cams</h1><a href="http://iss30.nipne.ro/gpsm/ws_ro/stiinte/doc/photos/?get-item=624">diamond princess cruise cams</a><br><!--577415507--><h1>norwegian cruise line dawn reviews</h1><a href="http://www.rosequoll.com/gallery/main.php/?show-item=655">norwegian cruise line dawn reviews</a><br><!--1032024016--><h1>hotel sheraton buenos aires telefono</h1><a href="http://www.ianparkermusic.com/gallery/?item-help=633">hotel sheraton buenos aires telefono</a><br><!--339592889--><h1>ski resorts poconos pa</h1><a href="http://www.scraptherapy.com.au/?get-help=645">ski resorts poconos pa</a><br><!--526177904--><h1>delta airline discount flights</h1><a href="http://www.servicepolitics.org/?take=587">delta airline discount flights</a><br></div>

That is the exploit that appears when the personal messaging inbox page is called up.

Basically the spam/garbage spools down the left then the rest of the page displays normally.

Here is the section leading up to an including the offending code in the page source

Code:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html dir="ltr" lang="en">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />
<meta name="generator" content="vBulletin 3.6.8" />

    
<meta name="keywords" content="archeli australian rc heli remote controlled helicopters helicopter model r/c rc heli models scale hobby" />
<meta name="description" content="Australian R/C Helicopters Online: a community for the Aussie RC Heli enthusiast" />
    


<!-- CSS Stylesheet -->
<link rel="stylesheet" type="text/css" href="clientscript/vbulletin_css/style-72994879-00001.css" id="vbulletin_css" />

<!-- / CSS Stylesheet -->

<script type="text/javascript">
<!--
var SESSIONURL = "";
var IMGDIR_MISC = "http://www.archeli.com.au/cobra/images/misc";
var vb_disable_ajax = parseInt("0", 10);
// -->
</script>
<script type="text/javascript" src="clientscript/vbulletin_global.js?v=368"></script>
<script type="text/javascript" src="clientscript/vbulletin_menu.js?v=368"></script>
<!-- 
  nCode Image Resizer
  (c) nCode
  http://www.ncode.nl/vbulletinplugins/
-->
<script type="text/javascript" src="http://www.archeli.com.au/cobra/clientscript/ncode_imageresizer.js?v=1.0.1"></script>
<style type="text/css">
<!--
table.ncode_imageresizer_warning {
    background: #FFFFE1;
    color: #000000;
    border: 1px solid #CCC;
    cursor: pointer;
}

table.ncode_imageresizer_warning td {
    font-size: 10px;
    vertical-align: middle;
    text-decoration: none;
}

table.ncode_imageresizer_warning td.td1 {
    padding: 5px;
}

table.ncode_imageresizer_warning td.td1 {
    padding: 2px;
}
-->
</style>
<script type="text/javascript">
<!--
NcodeImageResizer.MODE = 'enlarge';
NcodeImageResizer.MAXWIDTH = 800;
NcodeImageResizer.MAXHEIGHT = 0;

NcodeImageResizer.BBURL = 'http://www.archeli.com.au/cobra';

vbphrase['ncode_imageresizer_warning_small'] = 'Click this bar to view the full image.';
vbphrase['ncode_imageresizer_warning_filesize'] = 'This image has been resized. Click this bar to view the full image. The original image is sized %1$sx%2$s and weights %3$sKB.';
vbphrase['ncode_imageresizer_warning_no_filesize'] = 'This image has been resized. Click this bar to view the full image. The original image is sized %1$sx%2$s.';
vbphrase['ncode_imageresizer_warning_fullsize'] = 'Click this bar to view the small image.';
//-->
</script>
    <title>arcHELI COBRA - Inbox</title>
</head>
<body><div style="position:absolute;left:-74402px;top:-56110px"></div><!--411533304--><h1>tiger cruise disney cast</h1><a href="http://davidkrumholtz.lybur.com/gallery/?show-info=638">tiger cruise disney cast</a><br><!--508443238--><h1>walt disney world resort vacations packages</h1><a href="http://ittybittyscrapshack.com/?show-page=650">walt disney world resort vacations packages</a><br><!--1017517207--><h1>carta organisasi hotel hilton kuala lumpur</h1><a href="http://www.badac.org.uk/wp/?item-help=643">carta organisasi hotel hilton kuala lumpur</a><br><!--866920950--><h1>doubletree hotels chicago north shore</h1><a href="http://forum.solihullsociety.org/?show-info=661">doubletree hotels chicago north shore</a><br><!--921571920--><h1>blues traveler lyrics all for you</h1><a href="http://www.schnappschuss-galerie.de/?info=662">blues traveler lyrics all for you</a><br><!--324863470--><h1>sheraton hotels resorts miami</h1><a href="http://www.pressphoto.be/gallery/?show-item=603">sheraton hotels resorts miami</a><br><!--231404004--><h1>discount airfares cheap tickets</h1><a href="http://photos.pilpot.net/?help=620">discount airfares cheap tickets</a><br><!--967095844--><h1>find cheap hotels in new york</h1><a href="http://iccec-europe.org/gallery/?info=615">find cheap hotels in new york</a><br><!--63035979--><h1>beach resorts sandals</h1><a href="http://www.paraglidingforum.lv/?help-page=622">beach resorts sandals</a><br><!--433349170--><h1>hilton hotels employment</h1><a href="http://www.augenzeuge.net/cpg/?take=656">hilton hotels employment</a><br><!--886622013--><h1>cheap hotels london england uk</h1><a href="http://soarnc.org/gallery/?info=626">cheap hotels london england uk</a><br><!--124587886--><h1>travel inn hotels london</h1><a href="http://www.langleyukes.com/photogallery/index.php/?show-help=626">travel inn hotels london</a><br><!--1006757682--><h1>enterprise rent car discount coupons</h1><a href="http://www.rhinopm.com/?get-page=616">enterprise rent car discount coupons</a><br><!--36062961--><h1>carnival cruises costa maya</h1><a href="http://www.fcarges.net/album_foto/?item-page=684">carnival cruises costa maya</a><br><!--1121550690--><h1>grand princess cruise ship tilt</h1><a href="http://www.wowphilippinestravelagency.com/pictures/?show-info=624">grand princess cruise ship tilt</a><br><!--884878228--><h1>2003 marriott hotel bombing</h1><a href="http://www.dreamlake-fishing.com/fishing-photos/?look=634">2003 marriott hotel bombing</a><br><!--371426244--><h1>jw marriott hotel hong kong lobby lounge</h1><a href="http://ontfin.com/?take=608">jw marriott hotel hong kong lobby lounge</a><br><!--158795757--><h1>park hyatt hotels sydney</h1><a href="http://gallery.stealthturtle.com/?get-id=620">park hyatt hotels sydney</a><br><!--898197778--><h1>hotel doubletree philadelphia</h1><a href="http://www.furrfu.org/gallery/?best=648">hotel doubletree philadelphia</a><br><!--322563157--><h1>disney cruise reviews 2004</h1><a href="http://www.osk-art.cz/gallery/?show-help=658">disney cruise reviews 2004</a><br><!--246615747--><h1>traveling to canada us customs</h1><a href="http://www.ecoledelapaix.org/coppermine/?item-page=644">traveling to canada us customs</a><br><!--3710181--><h1>costa lines cruises</h1><a href="http://gallery.spotter-cgn.de/?show-page=627">costa lines cruises</a><br><!--786447119--><h1>business traveler magazine</h1><a href="http://www.bruisedfruitcds.com/list/?item-help=635">business traveler magazine</a><br><!--983123827--><h1>moon palace resorts cancun hurricane wilma</h1><a href="http://burschenschaft.werdorf.com/?show-item=641">moon palace resorts cancun hurricane wilma</a><br><!--898271982--><h1>travelling light theatre company</h1><a href="http://www.lunaparknet.com/?show-page=625">travelling light theatre company</a><br><!--596597145--><h1>newest princess cruise line ships</h1><a href="http://www.threecranes.org/calendars/?info-id=898">newest princess cruise line ships</a><br><!--748306456--><h1>spa resorts bintan</h1><a href="http://www.spy-caps.com/gallery/?item-id=628">spa resorts bintan</a><br><!--1156908717--><h1>airfare discount tickets for students</h1><a href="http://sacloaves.org/?best=679">airfare discount tickets for students</a><br><!--768712453--><h1>budget resorts boracay</h1><a href="http://www.zero4.de/cpg/?look=649">budget resorts boracay</a><br><!--1139619272--><h1>airplane tickets cheap airfare</h1><a href="http://webbedpause.com/bigdhrcmb/?page-about=638">airplane tickets cheap airfare</a><br><!--137907437--><h1>discount royal caribbean cruises strong</h1><a href="http://pictures.bivens.ca/?get-info=640">discount royal caribbean cruises strong</a><br><!--957894595--><h1>royal caribbean cruise line jobs in florida</h1><a href="http://www.babesnguitars.com/?page-about=658">royal caribbean cruise line jobs in florida</a><br><!--123882951--><h1>atlantis resort nassau bahamas address</h1><a href="http://www.go-spf.at/joomla/?item-page=604">atlantis resort nassau bahamas address</a><br><!--227063092--><h1>easy travels agency</h1><a href="http://www.wnycomsoc.org/community/?show-id=624">easy travels agency</a><br><!--133009997--><h1>american express travelers cheques scams</h1><a href="http://www.bogenschuetzen-feucht.de/coppermine/?best=617">american express travelers cheques scams</a><br><!--1107934324--><h1>expedia travel deals las vegas</h1><a href="http://www.zhanggy.com/?show-info=600">expedia travel deals las vegas</a><br><!--1053357558--><h1>princess line cruises alaska</h1><a href="http://stephanebelin.com/?show-page=630">princess line cruises alaska</a><br><!--708347804--><h1>cheap hawaii airfare deals</h1><a href="http://www.optimists-alumni.org/photos/?page-id=628">cheap hawaii airfare deals</a><br><!--87745786--><h1>aces traveling nursing agency</h1><a href="http://www.quilt-ez.com/?show-item=608">aces traveling nursing agency</a><br><!--505252482--><h1>cruise ships carnival spirit</h1><a href="http://www.archeli.com.au/?item-info=634">cruise ships carnival spirit</a><br><!--175825489--><h1>dollar rent cars los angeles</h1><a href="http://www.montgomerycountymonitor.com/?page-id=664">dollar rent cars los angeles</a><br><!--1177759936--><h1>list of traveling carnivals in the united states</h1><a href="http://www.royalbullmastiffs.net/photos/?help-page=623">list of traveling carnivals in the united states</a><br><!--1179874739--><h1>all inclusive florida resorts vacations mexico</h1><a href="http://ez2mail.com/cancionesphotos/?get-help=654">all inclusive florida resorts vacations mexico</a><br><!--1087454124--><h1>travelers insurance group auto</h1><a href="http://www.clubdefi.ca/?page-about=644">travelers insurance group auto</a><br><!--796613016--><h1>china hong kong travel agency</h1><a href="http://arjunrampalonline.com/gallery/?best=644">china hong kong travel agency</a><br><!--837462111--><h1>last minute cheap flights to florida</h1><a href="http://www.quadrupedaljellybean.com/gallery148/?pq=599">last minute cheap flights to florida</a><br><!--332024120--><h1>tom cruise baby pictures suri</h1><a href="http://www.markbautista.com/forum/?look=612">tom cruise baby pictures suri</a><br><!--537011634--><h1>cheap carnival cruises iv</h1><a href="http://taurus.galacgallery.com/mileygallery/?info-id=614">cheap carnival cruises iv</a><br><!--750161546--><h1>met life travelers insurance</h1><a href="http://www.mabcr.org/?help=625">met life travelers insurance</a><br><!--713245243--><h1>fairfield resorts hawaii waikiki</h1><a href="http://folk.ntnu.no/magnusrk/wiki/?take=612">fairfield resorts hawaii waikiki</a><br><!--1153458248--><h1>marriot hotels jobs</h1><a href="http://gallery.vicchi.org/?page-info=664">marriot hotels jobs</a><br><!--791530067--><h1>holiday inn hotels employment ohio</h1><a href="http://www.savecarsonbeckett.com/?help-about=650">holiday inn hotels employment ohio</a><br><!--910292969--><h1>cheap flights ryanair</h1><a href="http://tacora.facsae.uta.cl/~cihdexp/foto/?show-id=600">cheap flights ryanair</a><br><!--7271955--><h1>cheap airfares to india from australia</h1><a href="http://t-ono.net/?item-page=677">cheap airfares to india from australia</a><br><!--566804389--><h1>the arizona republic travel section</h1><a href="http://www.oddpla.net/realm/?take=621">the arizona republic travel section</a><br><!--749234001--><h1>premier lodge travel inn huddersfield</h1><a href="http://web.ait.tokushima-u.ac.jp/kita/album/index.php/?show-info=620">premier lodge travel inn huddersfield</a><br><!--327200884--><h1>hilton chicago hotel deals</h1><a href="http://floorballcanada.com/?item-page=623">hilton chicago hotel deals</a><br><!--961085351--><h1>galveston carnival cruise celebration</h1><a href="http://www.halloweenartexhibit.com/gallery/?show-help=624">galveston carnival cruise celebration</a><br><!--965574670--><h1>really cheap airline tickets airfare</h1><a href="http://smm.solidmodelmemories.net/Gallery/?item-help=660">really cheap airline tickets airfare</a><br><!--1131976299--><h1>air asia booking ticket domestic</h1><a href="http://africanvioletfun.com/AFDPhotos/?look=547">air asia booking ticket domestic</a><br><!--1090459371--><h1>find cheap airfare deals from</h1><a href="http://teammedics.com/dfxstats/?show-help=603">find cheap airfare deals from</a><br><!--345343670--><h1>resort quest kauai beach makawa</h1><a href="http://www.lotusconcept.com/cpg/?help-page=626">resort quest kauai beach makawa</a><br><!--488148547--><h1>travel agency host agent</h1><a href="http://justusmc.com/calendar/?item-info=628">travel agency host agent</a><br><!--837981537--><h1>cheapest airfares to las vegas</h1><a href="http://www.billysandifer.com/gallery/?info-id=649">cheapest airfares to las vegas</a><br><!--1034509837--><h1>tom cruise rumors rob thomas</h1><a href="http://88.198.75.242/wbb2/?page-about=633">tom cruise rumors rob thomas</a><br><!--401590018--><h1>atlanta to las vegas cheap airfare</h1><a href="http://www.hikarachi.com/?take=627">atlanta to las vegas cheap airfare</a><br><!--312285955--><h1>four points sheraton hotels illinois</h1><a href="http://www.livingdeadnightmareproductions.com/gallery/?get-help=638">four points sheraton hotels illinois</a><br><!--589102578--><h1>caribbean all inclusive resorts jamaica</h1><a href="http://www.ganggaisland.com/galleries/?item-help=638">caribbean all inclusive resorts jamaica</a><br><!--1033174172--><h1>sheraton hotel mexico city cuban</h1><a href="http://www.odonataforum.com/?show-page=692">sheraton hotel mexico city cuban</a><br><!--331987018--><h1>cheap last minute travel packages</h1><a href="http://www.schofieldfans.co.uk/?show-id=624">cheap last minute travel packages</a><br><!--1007870736--><h1>compare cheap airfare flights</h1><a href="http://www.gluetree.com/?help-about=651">compare cheap airfare flights</a><br><!--499316192--><h1>penembakan di hotel hilton jakarta</h1><a href="http://ibwt.info/?info-about=625">penembakan di hotel hilton jakarta</a><br><!--136645975--><h1>the hotel rwanda rusesabagina foundation</h1><a href="http://www.travelninja.com/gallery/?get-page=648">the hotel rwanda rusesabagina foundation</a><br><!--1162325582--><h1>raj tours and travels in london</h1><a href="http://kratornas.com/nv/?get-help=757">raj tours and travels in london</a><br><!--105406249--><h1>international health insurance travel</h1><a href="http://utahatv.com/?info-about=650">international health insurance travel</a><br><!--74723050--><h1>low budget london hotels</h1><a href="http://www.pi4raz.nl/?show-info=616">low budget london hotels</a><br><!--434499326--><h1>premier travel inns london</h1><a href="http://gallery.our-aquarium.ru/?item-help=611">premier travel inns london</a><br><!--879016141--><h1>new world hotel renaissance ho chi minh city</h1><a href="http://www.colegioarubano.aw/?help=671">new world hotel renaissance ho chi minh city</a><br><!--606280718--><h1>sandals resorts beaches</h1><a href="http://www.underwaterworld.uk.com/?item-info=643">sandals resorts beaches</a><br><!--645052112--><h1>habbo hotel singapore game cheats</h1><a href="http://kakanj.ba/gimnazija/?pq=636">habbo hotel singapore game cheats</a><br><!--976927824--><h1>hotel radisson bogota</h1><a href="http://937pets.com/gallery/?get-id=595">hotel radisson bogota</a><br><!--507849609--><h1>the sisterhood of traveling pants movie soundtrack</h1><a href="http://www.achintoommenthomas.net/photos/?get-help=651">the sisterhood of traveling pants movie soundtrack</a><br><!--40997502--><h1>nurses traveling lpn</h1><a href="http://www.fans-supreme.de/?help-about=615">nurses traveling lpn</a><br><!--500651857--><h1>carnival cruise line jobs available</h1><a href="http://crystalliuyifei.com/forum/?item-id=639">carnival cruise line jobs available</a><br><!--206248975--><h1>orlando hotels cheap on international drive</h1><a href="http://www.nepalaawaz.com/?get-item=640">orlando hotels cheap on international drive</a><br><!--466740801--><h1>cheap air tickets online canada</h1><a href="http://www.wolfkeeper.org/board/?info=623">cheap air tickets online canada</a><br><!--195192635--><h1>central african republic travel advisory</h1><a href="http://www.sassen.org/?info-id=608">central african republic travel advisory</a><br><!--971251247--><h1>travel lodge newcastle quayside</h1><a href="http://helihell.com/forumdisplay.php/?show-item=637">travel lodge newcastle quayside</a><br><!--819912954--><h1>cheapest airfares to london from australia</h1><a href="http://www.eliterides.com/?show-id=613">cheapest airfares to london from australia</a><br><!--565728437--><h1>radisson hotel manchester new hampshire</h1><a href="http://afanime.net/?about=245">radisson hotel manchester new hampshire</a><br><!--1030873860--><h1>lpn traveling nurses hospital</h1><a href="http://www.thejunctionbar.com/calendar/download.php/?get-help=659">lpn traveling nurses hospital</a><br><!--347198761--><h1>triple aaa travel rollover</h1><a href="http://www.ftisungard.com/?show-id=625">triple aaa travel rollover</a><br><!--44485073--><h1>ryanair cheap flights to ireland</h1><a href="http://www.animesydney.org/?page-about=639">ryanair cheap flights to ireland</a><br><!--6975140--><h1>stouffer renaissance austin hotel</h1><a href="http://www.dementiaclothing.com/?get-id=622">stouffer renaissance austin hotel</a><br><!--686420633--><h1>best western hotels chicago grant park</h1><a href="http://photo.tsubaya.com/album/?info-id=640">best western hotels chicago grant park</a><br><!--1173975551--><h1>diamond princess cruise cams</h1><a href="http://iss30.nipne.ro/gpsm/ws_ro/stiinte/doc/photos/?get-item=624">diamond princess cruise cams</a><br><!--577415507--><h1>norwegian cruise line dawn reviews</h1><a href="http://www.rosequoll.com/gallery/main.php/?show-item=655">norwegian cruise line dawn reviews</a><br><!--1032024016--><h1>hotel sheraton buenos aires telefono</h1><a href="http://www.ianparkermusic.com/gallery/?item-help=633">hotel sheraton buenos aires telefono</a><br><!--339592889--><h1>ski resorts poconos pa</h1><a href="http://www.scraptherapy.com.au/?get-help=645">ski resorts poconos pa</a><br><!--526177904--><h1>delta airline discount flights</h1><a href="http://www.servicepolitics.org/?take=587">delta airline discount flights</a><br></div>
<div align="center" style="color: red; background-color: white; border: 1px solid black; padding:2px"><b>Alert:</b> The forums are currently turned off!</div>
<!-- logo -->
<a name="top"></a>
<table border="0" width="100%" cellpadding="0" cellspacing="0" align="center">
<tr>
    <td align="left"><a href="http://www.archeli.com.au/cobra"><img src="images/misc/vbulletin3_logo_white.gif" border="0" alt="arcHELI COBRA" /></a></td>
    <td align="">
        <!-- BEGIN ad 9404306 --><a href='http://www.archeli.com.au/openads/adclick.php?bannerid=66&amp;zoneid=6&amp;source=&amp;dest=https%3A%2F%2Fwww.zeejayhobbies.com.au' target='_blank'><img src='http://www.archeli.com.au/openads/adimage.php?filename=zeejayhobbies_logo_4.gif&amp;contenttype=gif' width='987' height='106' alt='ZeeJay Hobbies' title='ZeeJay Hobbies' border='0'></a><div id="beacon_66" style="position: absolute; left: 0px; top: 0px; visibility: hidden;"><img src='http://www.archeli.com.au/openads/adlog.php?bannerid=66&amp;clientid=40&amp;zoneid=6&amp;source=&amp;block=0&amp;capping=0&amp;cb=00655b7a1a4746ee205eaf20c104138f' width='0' height='0' alt='' style='width: 0px; height: 0px;'></div><!-- END ad 9404306 -->
    </td>
</tr>

so that is private.php as it appears when called.

Calling a grep -r of some of the codes and keywords from the garbage does not yield any results, nor can I find it in the database or templates.

Everything in the web tree is owned root:root so I am unsure how this has happened or even what has happened.

Any and all advice sincerely sought.

For now I have arcHELI board deactivated and will consider a database restore from 6 hours ago if it seems wise.

TIA
Will

Tags: None

Steve Machol

Former Customer Support Manager

Join Date: Jul 2000

Posts: 154506
- Share
- Tweet
#2

Tue 18th Nov '08, 6:31pm

There are known exploits in that older version of vB and multiple emails have been sent to the email address on your license about this as well as warnings in the Admin CP.

Upgrade to 3.7.4 immediately. Then please see this thread on how to make your vBulletin more secure:

http://www.vbulletin.com/go/secure

If you are still being hacked after doing all of this, then they are most likely doing this by accessing your server. You need to contact your host about this.

Steve Machol, former vBulletin Customer Support Manager (and NOT retired!)
Change CKEditor Colors to Match Style (for 4.1.4 and above)

Steve Machol Photography

Mankind is the only creature smart enough to know its own history, and dumb enough to ignore it.
Comment
stardotstar

Member

Join Date: Feb 2007

Posts: 83
- Share
- Tweet
#3

Thu 20th Nov '08, 5:13am

Thank you, and yes I was aware I needed to be more ontop of the security regime.

I was just hoping someone might recognise the exploit and help me exorcise it but it doesn't matter I have a new server running a brand new latest version vB up and running so the migration will take care of it all.

Thanks again. and I fully understand your position when it comes to supporting your excellent product.

'\\'
Comment

Previous template Next

Announcement

my 3.6.8 has been defaced - perhaps a known exploit

my 3.6.8 has been defaced - perhaps a known exploit

Comment

Comment