Register Members List Search Today's Posts Mark Forums Read

Reply
 
Thread Tools
  #16  
Old 02 Jan 2013, 16:56
Traxdata Traxdata is offline
 
Join Date: Jul 2004
The problem found, it was also infected .htaccess file in www, I have added one in root but not in www............... shame on me.

. so if one of you will ge the same issue.

But still - it were about 10 infected vbulletin files - you have to delete them, you can easily find them but checking the date - the older and not changed ones are harmful, only recently changed you have to delete and replace with old original files.

The problem came with Filezilla, it seems to be well known problem, I would recommend to login with SFTP and not with FTP if using Filezilla and then changing all the PWs.

--------------- Added 02 Jan 2013 at 17:05 ---------------

Originally Posted by Simon Lloyd View Post
It seems to me that one or more of your core files hasn't been overwritten, you will also have a file or two which doesn't belong in your forum root which is rewriting the infection every time it doesn't see it, my suggestion would be to rename your forum folder add a new folder then name it to what your forum folder was, upload all fresh files (with the install/install.php deleted and the config.php.new edited for your database and renamed to config.php) and then try to access, if you can then you need to search your old folder for files that shouldn't be there, delete them, then upload with overwrite via ftp in ascii mode your fresh files in to the renamed folder, rename the temp folder to something else and then rename your old folder back to it's original and see how you go.
YEs, it was the first I did, I deleted and replaced all recently changed files (.php), all index.html and other .html files, and have created new .htaccess but did not in www, it was such waste of time! I could be ready within 10 minutes.

Database was not effected - thankfully!!! since it could take ages to restore.

Last edited by Traxdata; 02 Jan 2013 at 17:07.
Reply With Quote
  #17  
Old 02 Jan 2013, 17:08
Amaury Amaury is offline
 
Join Date: Nov 2011
Real name: Amaury
I'd suggest filing a ticket so vBulletin can help.

Also, which version of vBulletin 3 are you running?
__________________
I am a former vBulletin user and am no longer regularly active here.

KH-Flare moved to XenForo on January 1, 2014.
Reply With Quote
  #18  
Old 02 Jan 2013, 17:20
Simon Lloyd's Avatar
Simon Lloyd Simon Lloyd is offline
 
Join Date: Aug 2008
Real name: Simon
Originally Posted by Traxdata View Post
The problem came with Filezilla, it seems to be well known problem, I would recommend to login with SFTP and not with FTP if using Filezilla and then changing all the PWs.
Thats possible because filezilla stores your passwords as plain text, however, the passwords will not have been transmitted elsewhere by filezilla but rather you have/had an infection on your own pc that's found and relayed these.

--------------- Added 02 Jan 2013 at 17:23 ---------------

One other thing, if your .htaccess was infected then thats not an issue with vbulletin but more with a server vulnerability as only you or your server control panel can affect the .htaccess.
__________________
Kind regards,
Simon Microsoft Office Help
My Mods: Find my modifications here
Please do not pm me for support unless i have invited you to!
Reply With Quote
  #19  
Old 02 Jan 2013, 17:23
Max Taxable's Avatar
Max Taxable Max Taxable is offline
 
Join Date: Feb 2011
Originally Posted by Simon Lloyd View Post
Thats possible because filezilla stores your passwords as plain text, however, the passwords will not have been transmitted elsewhere by filezilla but rather you have/had an infection on your own pc that's found and relayed these.
Couldn't thank the post so, thanks here! You are 100% correct.
Reply With Quote
  #20  
Old 02 Jan 2013, 17:31
Simon Lloyd's Avatar
Simon Lloyd Simon Lloyd is offline
 
Join Date: Aug 2008
Real name: Simon
You're too kind , although this is sadly true in so many "i've been hacked" cases, we're all guilty of some security faux pas at sometime or another and only realise it when our world seems like it's caved in!
__________________
Kind regards,
Simon Microsoft Office Help
My Mods: Find my modifications here
Please do not pm me for support unless i have invited you to!
Reply With Quote
  #21  
Old 02 Jan 2013, 17:52
Traxdata Traxdata is offline
 
Join Date: Jul 2004
I ran vb since 07/2004, and it was for the first time, I know how to spell -security-.

if it will happen to someone - search for .htaccess files on your whole server (via ssh or sftp), they will be everywhere in vb folders. you have to delete them all.
Reply With Quote
  #22  
Old 02 Jan 2013, 17:55
ForceHSS's Avatar
ForceHSS ForceHSS is offline
 
Join Date: Apr 2008
Originally Posted by Traxdata View Post
I ran vb since 06/2004, and it was for the first time, I know how to spell -security-.
you get all this help then you say that
Reply With Quote
  #23  
Old 02 Jan 2013, 17:59
In Omnibus's Avatar
In Omnibus In Omnibus is offline
 
Join Date: Apr 2010
Real name: Kris
Originally Posted by Simon Lloyd View Post
You're too kind , although this is sadly true in so many "i've been hacked" cases, we're all guilty of some security faux pas at sometime or another and only realise it when our world seems like it's caved in!
Which is why responsible administrators backup their forums at least once daily and to multiple locations.
Reply With Quote
  #24  
Old 02 Jan 2013, 18:58
doctorsexy's Avatar
doctorsexy doctorsexy is offline
 
Join Date: Apr 2011
Real name: Chris
I'd suggest getting some Av for your Pc..
__________________
http://sandstormradio.org
Reply With Quote
  #25  
Old 02 Jan 2013, 20:05
Max Taxable's Avatar
Max Taxable Max Taxable is offline
 
Join Date: Feb 2011
Originally Posted by Traxdata View Post
I ran vb since 07/2004, and it was for the first time, I know how to spell -security-.

if it will happen to someone - search for .htaccess files on your whole server (via ssh or sftp), they will be everywhere in vb folders. you have to delete them all.
Clean your own registry first, friend. Start with this utility:

http://www.mcafee.com/apps/free-tool...s/stinger.aspx
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 21:45.

Layout Options | Width: Wide Color: