Unable to edit posts

[bobby972]

We are running vBulletin 4.2.0 Patch Level 2. We are not using any customization or any custom templates or anything like that. We have not made any changes ourselves to the software either.

However, for the past couple of days, we are unable to edit the posts.

In Google Chrome, it just showing waiting, waiting (Ajax type).

In Internet Explorer 8, it just shows JavaScript error by vbulletin_quick_edit.js
'null' is null or not an object
/forum/clientscript/vbulletin_quick_edit.js?v=420

We also using default mobile style for last one year, if that information is of any use.

We also created a brand new 'vb4 Default Style' and still the same problem.

[Zachery]

What version of PHP are you on?

[bobby972]

PHP Version 5.3.27

[bobby972]

Any update please?

[Mark.B]

Could you please make your default vB4 style available for guests to select?

[bobby972]

That is what the current set up is.

In other words, by default, it displays 'vB4 Default Style'.

Only other style they can choose is 'Default Mobile Style'.

There are no other styles in our forum.

[Zachery]

I'd suggest following these anyway, based on what I saw in a ticket recently:

Please read the following two blog posts:

http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked

http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site

[bobby972]

You think someone has hacked into our forum? What would they get out of just disabling the editing of the posts?

Is it possible for you to suggest me some specific solution to my specific problem?

By the way, I switched the style to 'Default Mobile Style' and I am able to edit the post.

Therefore, it seems something is wrong with 'vB4 Default Style'.

[bobby972]

One more thing.

When we installed the current version of vBulletin forum last year, we had taken the back up of all the files within the /forum/ directory and sub directories.

I already uploaded all of those files all over again. Therefore, in case if any of the files were corrupted/hacked, that would have fixed that. Isn't it?

But I still have the same problem.

[bobby972]

I confirmed that we have been hacked. The following is the control panel log.
I deleted the user.
Also, there were some plugins such as SkimLinks and something else. I deleted all of them.
Also, we have our own custom ads running on the forum. They were replaced by a Google Adwords. That has been fixed as well.
There is no more install directory.
However, our problem of not being able to edit the posts remains the same. Should I still do all the steps described in your big post? Or is there a short cut?

Please let me know.

135674	N/A	21:44, 2nd Sep 2013	options.php			182.189.75.33
135673	N/A	21:44, 2nd Sep 2013	options.php			182.189.75.33
135672	N/A	21:43, 2nd Sep 2013	template.php	updatetemplate	style id = 2	182.189.75.33
135671	N/A	21:42, 2nd Sep 2013	template.php	edit	style id = 0	182.189.75.33
135670	N/A	21:42, 2nd Sep 2013	template.php	modify		182.189.75.33
135669	N/A	21:42, 2nd Sep 2013	template.php	search		182.189.75.33
135668	N/A	21:41, 2nd Sep 2013	template.php	modify		182.189.75.33
135667	N/A	21:39, 2nd Sep 2013	plugin.php	edit	plugin id = 17	182.189.75.33
135666	N/A	21:39, 2nd Sep 2013	plugin.php	update	plugin id = 17	182.189.75.33
135665	N/A	21:38, 2nd Sep 2013	plugin.php	edit	plugin id = 17	182.189.75.33
135664	N/A	21:38, 2nd Sep 2013	plugin.php	update	plugin id = 17	182.189.75.33
135663	N/A	21:37, 2nd Sep 2013	plugin.php	edit	plugin id = 17	182.189.75.33
135662	N/A	21:36, 2nd Sep 2013	plugin.php	update	plugin id = 17	182.189.75.33
135661	N/A	21:36, 2nd Sep 2013	plugin.php	edit	plugin id = 17	182.189.75.33
135660	N/A	21:35, 2nd Sep 2013	plugin.php	update	plugin id = 17	182.189.75.33
135659	N/A	21:30, 2nd Sep 2013	plugin.php	edit	plugin id = 17	182.189.75.33
135658	N/A	21:30, 2nd Sep 2013	plugin.php	update	plugin id = 17	182.189.75.33
135657	N/A	21:29, 2nd Sep 2013	plugin.php	edit	plugin id = 17	182.189.75.33
135656	N/A	21:29, 2nd Sep 2013	plugin.php	update	plugin id = 17	182.189.75.33
135655	N/A	21:26, 2nd Sep 2013	plugin.php	edit	plugin id = 17	182.189.75.33
135654	N/A	21:26, 2nd Sep 2013	plugin.php	update	plugin id = 17	182.189.75.33
135653	N/A	21:24, 2nd Sep 2013	plugin.php	edit	plugin id = 17	182.189.75.33
135652	N/A	21:24, 2nd Sep 2013	plugin.php	update		182.189.75.33
135651	N/A	21:24, 2nd Sep 2013	plugin.php	add		182.189.75.33

[bobby972]

OK. I have done everything mentioned in your link.

1. Change everything. Done.
2. Upgrade from 4.2.0 Something to 4.2.1 Done
3. Recovering Admin access: Not applicable to me.
4. Restoring a database: Not applicable to me.

5. Removing unknown files:.

I ran Admin CP --> Diagnostics --> Suspect File Versions and found the following:


./
forum.php File not recognized as part of vBulletin
>>>> If I try to remove this, forum does not work any longer.

index.php File does not contain expected contents
>>> I just uploaded this from the latest version. I am not sure why this message still comes.


./clientscript/yui
connection.js File not recognized as part of vBulletin
dev-readme.txt File not recognized as part of vBulletin
yahoo-dom-event.js File not recognized as part of vBulletin


>>>> Should I safely delete these files?


./includes
adminfunctions_backup.php File not recognized as part of vBulletin
adminfunctions_ranks.php File not recognized as part of vBulletin
class_dm_picture.php File not recognized as part of vBulletin
datastore_cache.php File not recognized as part of vBulletin
db_mysql.php File not recognized as part of vBulletin
functions_bbcodeparse.php File not recognized as part of vBulletin
functions_bbcodeparse1.php File not recognized as part of vBulletin
functions_image.php File not recognized as part of vBulletin
functions_regimage.php File not recognized as part of vBulletin
functions_register.php File not recognized as part of vBulletin
functions_showthread.php File not recognized as part of vBulletin
functions_subscriptions.php File not recognized as part of vBulletin
functions_upload.php File not recognized as part of vBulletin
functions_wysiwyg.php File not recognized as part of vBulletin
functions_xml.php File not recognized as part of vBulletin
init_old.php File not recognized as part of vBulletin
mail.php File not recognized as part of vBulletin
sessions.php File not recognized as part of vBulletin

>>> Should I safely delete these files?

6. Removing unknown plugins:

Everything I see in Plugin Manager is the following. I am not sure if there is anything suspicious here.

itle	Hook Location	Active	Controls
Product : vBulletin
vBulletin	ajax_start		[Edit] [Delete]
Product : Forum Runner
Forum Runner: Admin Options Override	admin_options_print		[Edit] [Delete]
Forum Runner: Admin Options Processing	admin_options_processing		[Edit] [Delete]
Forum Runner: Admin Options: Print CMS Categories	admin_options_print		[Edit] [Delete]
Forum Runner: Append Detect Code	parse_templates		[Edit] [Delete]
Forum Runner: Cache Templates	cache_templates		[Edit] [Delete]
Forum Runner: Disable Incompatible Addons	global_bootstrap_init_complete		[Edit] [Delete]
Forum Runner: Location Display	online_location_unknown		[Edit] [Delete]
Forum Runner: Override standard_error()	error_generic		[Edit] [Delete]
Product : PostRelease
Cache	cache_templates		[Edit] [Delete]
Template Page	misc_start		[Edit] [Delete]
Thread List Page	forumdisplay_complete		[Edit] [Delete]
Product : Skimlinks Plugin
Add Skimlinks Classes to PostBit	postbit_display_complete		[Edit] [Delete]
Add Skimlinks JavaScript to footer template	showthread_complete		[Edit] [Delete]
Add Skimlinks Option to Edit Options Form	profile_editoptions_start		[Edit] [Delete]
Extend User DataManager	userdata_start		[Edit] [Delete]
Update Skimlinks Preference	profile_updateoptions		[Edit] [Delete]

Even though not visible in the above screen shot, everything except 'vBulletin' has been stricken through indicating not active/disabled.

Step 7, securing your site and moving forward:
Done


Please guide on how to proceed.

[bobby972]

I also tried to create a new style with no parent. Same problem.
I cleared browser cache, closed all windows and tried again. Same problem.

[bobby972]

OK. Finally, if I write the define('DISABLE_HOOKS', true); in includes/config.php, I am able to edit the posts.

But I am not sure whether that is the permanent solution.


Please guide.

[bobby972]

Any update?

[snakes1100]

You should disable your products one at a time through the product manager until the issue disappears, that will allow you to find out which hack is causing the issue, also verify there are no plugins that arent part of a addon in the plugin manager.