code forwarding from site...

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • GoTTi
    Senior Member
    • Jul 2002
    • 485

    code forwarding from site...

    there is code somewhere and I cant find it that is causing us to be forwarded to hostedopenx.com
    I have stopped the site from loading and I see when viewing source:


    Code:
    	[SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]<[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]script[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] [/SIZE][SIZE=2][COLOR=#ff0000][SIZE=2][COLOR=#ff0000]type[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]="text/javascript">[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]ame_toggle_view({other : [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2],post : [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2],blog : [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2],group : [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2],vm : [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2],sig : [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]});[/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]</[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]script[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]><[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]br[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] [/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]/>[/COLOR][/SIZE][/COLOR][/SIZE]
    
    
    	[SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]<[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]div[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] [/SIZE][SIZE=2][COLOR=#ff0000][SIZE=2][COLOR=#ff0000]class[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]="smallfont"[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] [/SIZE][SIZE=2][COLOR=#ff0000][SIZE=2][COLOR=#ff0000]align[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]="center">[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]All times are GMT. The time now is [/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]<[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]span[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] [/SIZE][SIZE=2][COLOR=#ff0000][SIZE=2][COLOR=#ff0000]class[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]="time">[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]01:40 AM[/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]</[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]span[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]>[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2].[/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]</[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]div[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]>[/COLOR][/SIZE][/COLOR][/SIZE]
    
    
    	[SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]<[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]br[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] [/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]/>[/COLOR][/SIZE][/COLOR][/SIZE]
    
    
    	[SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]<[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]script[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] [/SIZE][SIZE=2][COLOR=#ff0000][SIZE=2][COLOR=#ff0000]type[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]='text/javascript'>[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]<!--[/SIZE][SIZE=2][COLOR=#008000][SIZE=2][COLOR=#008000]//<![CDATA[[/COLOR][/SIZE][/COLOR][/SIZE]
    
    
    	[SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]var[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] m3_u = (location.protocol==[/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'http:'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]?[/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'http://hostedopenx.com/openx/www/delivery/ajs.php'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]:[/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'http://hostedopenx.com/openx/www/delivery/ajs.php'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]);[/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]var[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] m3_r = Math.floor(Math.random()*99999999999);[/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]if[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] (!document.MAX_used) document.MAX_used = [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]','[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2];document.write ([/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]"<scr"[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]+[/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]"ipt type='text/javascript' src='"[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]+m3_u);document.write ([/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]"?zoneid=29529"[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]);document.write ([/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'&amp;cb='[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] + m3_r);[/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]if[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] (document.MAX_used != [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]','[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]) document.write ([/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]"&amp;exclude="[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] + document.MAX_used);document.write (document.charset ? [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'&amp;charset='[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]+document.charset : (document.characterSet ? [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]'&amp;charset='[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]+document.characterSet : [/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]''[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]));document.write ([/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]"&amp;loc="[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] + escape(window.location));[/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]if[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] (document.referrer) document.write ([/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]"&amp;referer="[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] + escape(document.referrer));[/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]if[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] (document.context) document.write ([/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]"&context="[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] + escape(document.context));[/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]if[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2] (document.mmm_fo) document.write ([/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]"&amp;mmm_fo=1"[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]);document.write ([/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]"'><\/scr"[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]+[/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]"ipt>"[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2]);[/SIZE]
    
    
    	[SIZE=2][COLOR=#008000][SIZE=2][COLOR=#008000]//]]>-->[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]</[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#a31515][SIZE=2][COLOR=#a31515]script[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=2][COLOR=#0000ff][SIZE=2][COLOR=#0000ff]>[/COLOR][/SIZE][/COLOR][/SIZE]
    I don't know where this code is or what is causing it to load on the site....what template should I look in or what can someone point me to to find this problem and fix it. thanks!
  • AliMadkour
    Senior Member
    • Dec 2004
    • 1588
    • 6.X

    #2
    Frist try disabling your modifications/plugins and see if you still have this problem.
    Note: Note: To temporarily disable the plugin system, edit includes/config.php and add this line right under <?php



    PHP Code:
    define('DISABLE_HOOKS'true); 
    if the code still exist open AdminCP->Settings->Options->General Settings->Add Template Name in HTML Comments->Yes you should now know which template by viewing page source, ‘‘ You'll see the template name as a comment ’’

    if code removed then you've to check your plugins enable them one by one to know which one cause that problem,


    Former vBulletin Support Staff
    Need Help?, Or P.M. Me

    Comment

    • GoTTi
      Senior Member
      • Jul 2002
      • 485

      #3
      I turned off the plugins via admincp and it didn't forward when I logged out and was viewing the page as guest....
      so im looking at a plugin issue?

      Comment

      • GoTTi
        Senior Member
        • Jul 2002
        • 485

        #4
        and if its a plugin issue I guess ill have to go 1 at a time disabling them to see which one it is right?

        Comment

        • GoTTi
          Senior Member
          • Jul 2002
          • 485

          #5
          and it seems it is not forwarding on firefox, only ie

          Comment

          • AliMadkour
            Senior Member
            • Dec 2004
            • 1588
            • 6.X

            #6
            You'll need to disable plugins individually...one by one...in the ACP until you find the one causing the problem

            Former vBulletin Support Staff
            Need Help?, Or P.M. Me

            Comment

            • GoTTi
              Senior Member
              • Jul 2002
              • 485

              #7
              #sadface

              Comment

              • Trevor Hannant
                vBulletin Support
                • Aug 2002
                • 24326
                • 5.7.X

                #8
                Looking at the first line of what you posted, I'd try AME if you have that:

                Code:
                [SIZE=10px][COLOR=#0000ff][SIZE=10px][COLOR=#0000ff]<[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px][COLOR=#a31515][SIZE=10px][COLOR=#a31515]script[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px][COLOR=#ff0000][SIZE=10px][COLOR=#ff0000]type[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px][COLOR=#0000ff][SIZE=10px][COLOR=#0000ff]="text/javascript">[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px]ame_toggle_view({other : [/SIZE][SIZE=10px][COLOR=#a31515][SIZE=10px][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px],post : [/SIZE][SIZE=10px][COLOR=#a31515][SIZE=10px][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px],blog : [/SIZE][SIZE=10px][COLOR=#a31515][SIZE=10px][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px],group : [/SIZE][SIZE=10px][COLOR=#a31515][SIZE=10px][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px],vm : [/SIZE][SIZE=10px][COLOR=#a31515][SIZE=10px][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px],sig : [/SIZE][SIZE=10px][COLOR=#a31515][SIZE=10px][COLOR=#a31515]'true'[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px]});[/SIZE][SIZE=10px][COLOR=#0000ff][SIZE=10px][COLOR=#0000ff]</[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px][COLOR=#a31515][SIZE=10px][COLOR=#a31515]script[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px][COLOR=#0000ff][SIZE=10px][COLOR=#0000ff]><[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px][COLOR=#a31515][SIZE=10px][COLOR=#a31515]br[/COLOR][/SIZE][/COLOR][/SIZE][SIZE=10px][COLOR=#0000ff][SIZE=10px][COLOR=#0000ff]/>[/COLOR][/SIZE][/COLOR][/SIZE]
                Vote for:

                - Admin Settable Paid Subscription Reminder Timeframe (vB6)
                - Add Admin ability to auto-subscribe users to specific channel(s) (vB6)

                Comment

                • BirdOPrey5
                  Senior Member
                  • Jul 2008
                  • 9613
                  • 5.6.3

                  #9
                  Try searching the plugin table in the database with phpmyadming for some of the code, or search for base64 which is often used to encrypt malicious code.

                  Or there is a "Search Plugins" mod on vBulletin.org by kh99 that is handy for searching plugins- but as usual we do not provide support for 3rd party plugins.

                  Comment

                  • GoTTi
                    Senior Member
                    • Jul 2002
                    • 485

                    #10
                    i found out what it was. it was a mod. http://www.vbulletin.org/forum/showthread.php?t=201312 Cyb - Advanced Forum Rules

                    Comment

                    widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
                    Working...