Site hacked. Need help removing scripts please.

[ejhernandez]

We have a site that was compromised possibly via poorly managed file permissions (my fault). Site is on a shared server and it may be that another site on the server was compromised and we were targeted from there - don't know for sure. We have vBulletin and Photopost sharing a database and login data. It seems Photopost was compromised first, and then the forum was compromised. We had a recent version of vBulletin (circa 3.5 or 3.6), but not the most recent.

After much reading here and elsewhere, I have upgraded to 3.8.3 and changed the names of the admincp and modcp folders. Haven't quite mastered how to password protect using .htpasswd and .htaccess, but I'm working on it. I've set myself up as an undeletable user. Also, checking permissions on all files.

But... there remains a script right after the header when viewed in "view page source". Caution: there remains a script on the below link.

https://www.ndisb.com

the script (in the top of the body) reads (changed to protect this forum):

var dc=document.write
var sd=string.fromcharcode
var exe=url to an executable file on another site
dc(sc(followed by a long series of 2 or 3 digit numbers seperated by commas

My question is this - how can I find this script, and possibly others, that have been installed on my site and remove them?

As you can tell from this post, I could probably be categorized as knowing enough to get myself into trouble - which I apparently did.

Any help would be appreciated. I won't be able to check back for about 12 hours or so, but any assistance would prove helpful.

Thanks

[Silver_2000]

do a search on java script or iframe inserts

there are scripts that were written to clean them that you could use to scan and clean your server
Depending on what OS you are running

Try searching on Cpanel.net

[Jake Bunce]

That doesn't look like a vBulletin page:

http://www.ndisb.com/

In many cases I find the hackers have inserted their code into the templates. If your case fits the profile then you need to run this query on your database in phpmyadmin:

DELETE FROM template
WHERE template LIKE '%base64%'

Then run the "install/upgrade.php" script on your forum to reimport the XML.

Of course the ideal is to just restore a backup from before the incident.

Also, sometimes I find HTML inserted into these settings:

Admin CP -> vBulletin Options -> Site Name / URL / Contact Details

[ejhernandez]

That doesn't look like a vBulletin page:

http://www.ndisb.com/

Sorry. Should have been www.ndisb.com/forums

Thanks for the input to this point. I'll see what this turns up.

[ejhernandez]

If your case fits the profile then you need to run this query on your database in phpmyadmin:

DELETE FROM template
WHERE template LIKE '%base64%'

Then run the "install/upgrade.php" script on your forum to reimport the XML.

Of course the ideal is to just restore a backup from before the incident.

Also, sometimes I find HTML inserted into these settings:

Admin CP -> vBulletin Options -> Site Name / URL / Contact Details

In phpMyAdmin I typed your query into the SQL query on database box as instructed, and I get the following response:

You have to choose at least one column to display

I selected Field" 'VB_template".*, then after submitting the query I got the same response, but in the query box it changed to

FROM VB_template

Should I have selected the "Update Query" button instead?

Also, I checked and there is no HTML in the Contact Details area.

One other thing - I upgraded after the hack overwriting the original installation but this script is still there. Does that mean it is being inserted from elsewhere? And can't restore from backup as backups are overwritten daily and the hack is over one day old.

Thanks again.

[Jake Bunce]

The query should work. I can take a look if you submit a trouble ticket with all of your server and forum logins, as well as a URL and login for phpmyadmin:

http://members.vbulletin.com/membersupport_contactform.php