Help, my site possibly has some bit mining malware.

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • MasturB
    New Member
    • Jul 2013
    • 8
    • 4.2.X

    Help, my site possibly has some bit mining malware.

    I've had a few users complain their CPU resources were skyrocketing when visiting my site and then it going back to normal when not.

    My website is ChopCountry.com (just a web forum only). Can anyone see if they're getting the same issue?

    How can I identify and remove it?
  • Trevor Hannant
    vBulletin Support
    • Aug 2002
    • 24358
    • 5.7.X

    #2
    To troubleshoot this, first download a fresh copy of the vBulletin ZIP file from the Members Area then reupload all the original vB non-image files (except install.php). Make sure you upload these in ASCII format and overwrite the ones on the server. Also be sure to upload the admincp files to whichever directory you have set in your config.php file. Then run 'Suspect File Versions' in Diagnostics to make sure you have all the original files for your version and that none show 'File does not contain expected contents':

    Admin CP -> Maintenance -> Diagnostics -> Suspect File Versions

    [Note: In some cases you may also need to remove any of the listed .xml files in the includes/xml directory.]

    Next, disable all plugins.Note: To temporarily disable the plugin system, edit config.php and add this line right under <?php:

    define('DISABLE_HOOKS', true);

    Then if you still have this problem, create a new style and choose no parent style. This will force it to use the default templates. Finally empty your browser cache, close all browser windows then try again. Make sure you change to the new style and view your forums with it.

    Do you have the same problem?
    Vote for:

    - Admin Settable Paid Subscription Reminder Timeframe (vB6)
    - Add Admin ability to auto-subscribe users to specific channel(s) (vB6)

    Comment

    • MasturB
      New Member
      • Jul 2013
      • 8
      • 4.2.X

      #3
      Originally posted by Trevor Hannant
      To troubleshoot this, first download a fresh copy of the vBulletin ZIP file from the Members Area then reupload all the original vB non-image files (except install.php). Make sure you upload these in ASCII format and overwrite the ones on the server. Also be sure to upload the admincp files to whichever directory you have set in your config.php file. Then run 'Suspect File Versions' in Diagnostics to make sure you have all the original files for your version and that none show 'File does not contain expected contents':

      Admin CP -> Maintenance -> Diagnostics -> Suspect File Versions

      [Note: In some cases you may also need to remove any of the listed .xml files in the includes/xml directory.]

      Next, disable all plugins.Note: To temporarily disable the plugin system, edit config.php and add this line right under <?php:

      define('DISABLE_HOOKS', true);

      Then if you still have this problem, create a new style and choose no parent style. This will force it to use the default templates. Finally empty your browser cache, close all browser windows then try again. Make sure you change to the new style and view your forums with it.

      Do you have the same problem?

      Hey Trevor, I just got off with GoDaddy rep who checked the SQL. He says what he pinpointed the issue to possibly, was a Stats collector within the software itself that's making things labor intensive.

      I will try what you've asked unless you think it might be something else based on the GoDaddy's software guy's informatino.

      Comment

      • Trevor Hannant
        vBulletin Support
        • Aug 2002
        • 24358
        • 5.7.X

        #4
        Stats collector within vBulletin?
        Vote for:

        - Admin Settable Paid Subscription Reminder Timeframe (vB6)
        - Add Admin ability to auto-subscribe users to specific channel(s) (vB6)

        Comment

        widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
        Working...