[Forum] Hacked?

[G-man]

I am running the latest version with the security patches. Somewhere somehow someone managed to get some kind of code injected into my site that whenever you click on a page it opens up a browser with some very nasty garbage on it. I am in my Admin control panel and It also ahs this issue. It apears to be some sort of overlay code on the page. Where would they be hiding this that I cannot see it in the page source code?

[Wayne Luke]

What is the "nasty garbage" shown at the top of the page? I don't see anything when browsing your site as a guest.

[G-man]

We managed to get it cleaned up by applying the newest version. Thank you for looking. It was some sort of overlay code that made it where whenever you clicked on any part of the page it would bring up a malware page in another browser. I really need to get this site upgraded to the latest and great 5.0. Is there someone that can do it for a fee?

[Wayne Luke]

You can purchase a professional upgrade on the main page by clicking Purchase and then Addons.

[G-man]

Nope the malware is still there. Crap. I have shut down the forum for now. Wayne Luke is there a way I might be able to get some help figuring out the issue. It appears to be an overly of the whole site. It is even doing it in the Admin panel. If I click on anything it brings up a second instance of a browser with a maleware site on it. ihave ran through the page source code for over an hour and can't see anything wrong.

[Trevor Hannant]

Check your plugins here:

AdminCP > Plugins and Products > Plugin Manager

Often we see this come from a plugin that sits by itself at the top of the list that isn't part of an added Product. If there is one there, delete it.

Next, get up to date copies of all Products that you've got installed, update the files on your server and re-import the XML files for them to ensure that the correct code is held in your database.

For security, you should also change the following passwords:

- all Administrator accounts
- all FTP accounts
- your vBulletin database*

*Note that when you do this, you will need to edit includes/config.php to use the new password.

Does this resolve the problem?

[G-man]

All the plugins are disabled via the config file. Our people compared all the files to a fresh copy and found a code that did not belong in a file named vbulletin-sidebar.js. We replaced it with a clean version. We cleared the cach. We still have the issue. Also I am not sure how to re-import the XML files.

[Wayne Luke]

Nope the malware is still there. Crap. I have shut down the forum for now. Wayne Luke is there a way I might be able to get some help figuring out the issue. It appears to be an overly of the whole site. It is even doing it in the Admin panel. If I click on anything it brings up a second instance of a browser with a maleware site on it. ihave ran through the page source code for over an hour and can't see anything wrong.

Yes... There are step by step instructions in this topic: https://www.vbulletin.com/forum/foru...ring-your-site

It will tell you how to investigate vBulletin, find, and remove any malware on your site. It will tell you what you need to do to make sure it doesn't happen again in the future. Though, the software is only as secure as your server. If you're not using SMTP, SFTP, HTTPS, and other security protocols then your site can be at risk.