Possible hack?

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • Okuma Steve
    Member
    • May 2010
    • 79

    [Forum] Possible hack?

    This image from hqhrt.com keeps showing up in the footer template in my styles. I've removed it a few times in the past week. When the image tag is added back, it shows that the template has been edited last by me, but obviously, I didn't add it. It only shows up in a few styles, not all of them.

    HTML Code:
    <div id="footer_morecopyright" class="shade footer_morecopyright">    <!-- Do not remove cronimage or your scheduled tasks will cease to function -->
           <img style="display:none" src="http://hqhrt.com/content/67/tran.jpg" />
        {vb:raw cronimage}
        <!-- Do not remove cronimage or your scheduled tasks will cease to function -->
        {vb:raw vboptions.copyrighttext}
    </div>
    Anybody have this problem, or know what it might be? Apparently, it's been there for a while, and I haven't realized it. If you have a minute, please search your styles and see if you have it too. Thanks!
  • Okuma Steve
    Member
    • May 2010
    • 79

    #2
    Anybody?

    Comment

    • whitey10tc
      Senior Member
      • Jan 2011
      • 415
      • 4.0.x

      #3
      Link to your forum and more detail might allow more to help. Could be a compromised plugin? Do you use any copied "ripped" skins?
      www.cdmagurus.com
      www.cellphone-gurus.com

      Comment

      • Trevor Hannant
        vBulletin Support
        • Aug 2002
        • 24325
        • 5.7.X

        #4
        Please wait 24 hours before bumping threads as per the forum rules.

        If you're removing it from your template and it's being re-added then either:

        - someone is logging in and doing this or
        - there is a script on your server that's editing the DB directly

        For the first option, check your Control Panel Logs in AdminCP and see if there's anything there. For the second, you will need to check for any suspicious files - the Suspect File Version check can help with this in AdminCP > Maintenance > Diagnostics. Your host can also help with scanning the server
        Vote for:

        - Admin Settable Paid Subscription Reminder Timeframe (vB6)
        - Add Admin ability to auto-subscribe users to specific channel(s) (vB6)

        Comment

        • TheNewOne
          Senior Member
          • Aug 2011
          • 1033
          • 4.2.5

          #5
          change all your passwords

          Comment

          • BadgerDog
            New Member
            • May 2007
            • 14

            #6
            I have just started seeing this exact same problem as well ...

            Regards,
            Doug

            Comment

            • Hendrizius
              Member
              • May 2007
              • 83

              #7
              Originally posted by BadgerDog
              I have just started seeing this exact same problem as well ...

              Regards,
              Doug
              I have the same problem.
              www.duoblogger.com - blogging about advertising.
              Twitter: @hendricius

              Comment

              • Mark.B
                vBulletin Support
                • Feb 2004
                • 24286
                • 6.0.X

                #8
                Originally posted by Hendrizius
                I have the same problem.
                You should start your own thread with all the details, to enable the support team and others to assist you properly.
                MARK.B
                vBulletin Support
                ------------
                My Unofficial vBulletin 6.0.0 Demo: https://www.talknewsuk.com
                My Unofficial vBulletin Cloud Demo: https://www.adminammo.com

                Comment

                • Okuma Steve
                  Member
                  • May 2010
                  • 79

                  #9
                  Originally posted by Hendrizius
                  I have the same problem.
                  I never found the source of the problem, but I was able to make it stop happening by having all the admins change their passwords.

                  Comment

                  widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
                  Working...