Clicking site links creates a new spam tab in browser

[ipyuwebmaster]

On my production forum, I am current running 3.8.9 prior to upgrading to 4.2. It looks like I have pretty much the same thing going on as the topic listed here:

https://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/4353074-clicking-site-links-creates-a-new-spam-tab-in-browser-4-2-2

I am taking over management of this forum from a previous company admin and haven't really ever dug into vBulletin management until this year. I do have some other PHP bulletin experience and can work my way around though...

1) I don't really know what to do with the Diagnostics page.
2) includes only appear in humanverify_recaptcha

5) I have run the query suggested in the first reply and found

two base64 references in the vBulletin table as 'eval(gzinflate(base64_decode('
three 'exec' references as 'exec_header_redirect' in the 'Display Thread Readers' table and 'Cyb - Advanced Forum Statistics - FH' table
'exec' reference as 'exec_send_notification' in the 'Advanced merge posts' table
a few 'system' references as '// System Turned Off //' comments

6) found several

'exec' as 'exec_switch_bg()' in 'memberlist_resultsbit' and 'exec_refresh()' in 'WHOSONLINE' and 'STANDARD_REDIRECT'
'system' as 'init_forum_readmarker_system()' in 'forum home_markread_script' and 'features_private_messaging_system' in 'modifyoptions'

if it is the vBulletin references to base64 with the insanely long key code(?) after it, then I don't know what part to delete ...

[Wayne Luke]

There should be no base64 code anywhere in the vBulletin 3.x database. These are most likely plugins that are exploiting your server and should be deleted.

The exec you're locking for would be exec('some command here');. System would be similar. Like system('some command here'):

[ipyuwebmaster]

I am trying to get into this again because it looks like it is still an issue.

I am now getting this error on the homepage:

[B]Parse error[/B]: syntax error, unexpected 'http' (T_STRING) in [B]/home/illpumpyouup/public_html/index.php(599) : eval()'d code[/B] on line [B]3[/B]

and on the test site that I was checking all of the database code, I removed ALL of the 3rd party products and plugins and I am still getting the spam tabs opening when I click on a link in the site.

[Wayne Luke]

That line is the FORUMHOME template. Edit the template in the AdminCP and save it.