Register Members List Search Today's Posts Mark Forums Read

Reply
 
Mod Options
Check 4 Hack - Finds infected Datastore Entries Details »
Check 4 Hack - Finds infected Datastore Entries
Mod Version: 1.00, by Hoffi (Member) Hoffi is offline
Developer Last Online: Mar 2016 I like it Show Printable Version Email this Page

vB Version: 4.1.4 Rating: (7 votes - 4.57 average) Installs: 151
Released: 27 Jun 2011 Last Update: Never Downloads: 1012
Not Supported Uses Plugins Additional Files Translations  

Many Users have Problems with infected Webservers.

I wrote a small Cron-Job that searches the datastore for possible infects and tried to repair them.

1.0 Initial relase with one check:
Checks if a base64 Code resists in the Datastore. If it's found in the pluginlist, the Datastore will be rebuild.

For more Checks, tell them. I'll add them.

The Cron Job will be started every 20 Min, and sends a Mail to the entered Mailadress, or if non entered, to the webmaster eMail-adress.

Install:

Upload the upload Directory and install the XML File.

German Version is also integrated.

If you want to check the Plugin, enable the Demo-Plugin which is installed, too. Only if it's enabled, the Check will find this.

If this Mod detects an infect, please do not lean back! Research it, and fix your security Hole!

Download Now

Only licensed members can download files, Click Here for more information.

Show Your Support

  • To receive notifications regarding updates -> Click to Mark as Installed.
  • If you like this modification support the author by donating.
  • This modification may not be copied, reproduced or published elsewhere without author's permission.
  #16  
Old 30 Jun 2011, 00:08
djbaxter djbaxter is offline
 
Join Date: Aug 2006
Location: Ottawa, Canada
Originally Posted by davidg View Post
i m having this error when i try to import the xml file:
XML Error: not well-formed (invalid token) at Line 0
Originally Posted by TheLastSuperman View Post
Hmm sounds odd... try it once more and let us know... also are you uploading and typing in the location OR selecting from a folder on your PC?
It sounds to me like an incomplete or corrupted download. Try downloading the XML file again and reinstalling.
Reply With Quote
  #17  
Old 30 Jun 2011, 09:56
Hoffi's Avatar
Hoffi Hoffi is offline
 
Join Date: Nov 2001
Real name: Christian
No, It sends an eMail.
Reply With Quote
  #18  
Old 30 Jun 2011, 12:38
davidg davidg is offline
 
Join Date: Apr 2010
is working now i think it was my computer who caused that error
Reply With Quote
  #19  
Old 01 Jul 2011, 11:08
Lee G Lee G is offline
 
Join Date: Jun 2006
Real name: Lee
Can anyone please confirm this works with 3.8
Going by my flat line in traffic, it looks like I have been hit a second time in just over a year
Reply With Quote
  #20  
Old 01 Jul 2011, 11:27
BirdOPrey5's Avatar
BirdOPrey5 BirdOPrey5 is offline
 
Join Date: Jun 2008
Real name: Joe D.
I can't confirm it but I see no reason why it wouldn't.
__________________
-Joe
Former vb.org Moderator. Retired.

@BirdOPrey5 | All Things BOP5 | Joe's Ultimate Off Topic
Note - I no longer making new VB mods, sorry.
Reply With Quote
  #21  
Old 01 Jul 2011, 12:19
pantani's Avatar
pantani pantani is offline
 
Join Date: Dec 2007
will test it
Reply With Quote
  #22  
Old 01 Jul 2011, 14:29
djbaxter djbaxter is offline
 
Join Date: Aug 2006
Location: Ottawa, Canada
Originally Posted by Lee G View Post
Can anyone please confirm this works with 3.8
Going by my flat line in traffic, it looks like I have been hit a second time in just over a year
Originally Posted by BirdOPrey5 View Post
I can't confirm it but I see no reason why it wouldn't.
Originally Posted by pantani View Post
will test it
Yes, I have it running on one 4.1.4 forum and one 3.8.3 forum.
Reply With Quote
  #23  
Old 01 Jul 2011, 15:20
Lee G Lee G is offline
 
Join Date: Jun 2006
Real name: Lee
Fingers crossed, installed on a 3.8.1 forum
Cant find where to turn the test option on though
No doubt a dumb question
Reply With Quote
  #24  
Old 01 Jul 2011, 15:34
Habsy Habsy is offline
 
Join Date: Sep 2006
Does this work for 4.1.4?

Many thanks.
__________________
ForumICE.com
Reply With Quote
  #25  
Old 01 Jul 2011, 15:41
BirdOPrey5's Avatar
BirdOPrey5 BirdOPrey5 is offline
 
Join Date: Jun 2008
Real name: Joe D.
Originally Posted by Habsy View Post
Does this work for 4.1.4?

Many thanks.
In the very top post it says "vB version 4.1.4" so I would say yes, it does.
__________________
-Joe
Former vb.org Moderator. Retired.

@BirdOPrey5 | All Things BOP5 | Joe's Ultimate Off Topic
Note - I no longer making new VB mods, sorry.
Reply With Quote
  #26  
Old 01 Jul 2011, 16:03
djbaxter djbaxter is offline
 
Join Date: Aug 2006
Location: Ottawa, Canada
Originally Posted by Lee G View Post
Fingers crossed, installed on a 3.8.1 forum
Cant find where to turn the test option on though
No doubt a dumb question
No, not at all. This is a very useful add-on but doesn't have a lot of documentation.
  1. Admin CP >> vBulletin Options >> vBulletin Options

    select Server Settings and Optimization Options

    scroll down to "E-Mail adress: If a infect is detected, a warn mail will send to this adress. Then the System trys to repair" and enter the email address for notification.

  2. AdminCP >> Plugins & Products >> Plugin Manager

    scroll down to Product : Check 4 Hacking and find below that demo

    enable demo

  3. Admin CP >> Scheduled Tasks >> Scheduled Task Manager

    scroll down to "Check 4 Hacking: Test the datastore for infects"

    click on "Run Now"

    you should get an email saying the cron job has found an infection in demo

  4. Remember to go back and disable the demo plugin from step 2 above
Reply With Quote
  #27  
Old 01 Jul 2011, 16:32
MentaL's Avatar
MentaL MentaL is offline
 
Join Date: Jan 2003
i assume a blank email means no infection?
Reply With Quote
  #28  
Old 01 Jul 2011, 16:47
ata-k ata-k is offline
 
Join Date: Mar 2011
hello ... can you help? the program sent me this to my mail ...

Were the Following modules infected:

pluginlist

Is this normal?? or is it a virus?? and if a virus I do? I hope you can answer and help me ... thank you very much!
Reply With Quote
  #29  
Old 01 Jul 2011, 16:48
djbaxter djbaxter is offline
 
Join Date: Aug 2006
Location: Ottawa, Canada
Originally Posted by MentaL View Post
i assume a blank email means no infection?
Yes. That only happens once after the "infected" email, presumably to confirm that you're now clean.

Originally Posted by ata-k View Post
hello ... can you help? the program sent me this to my mail ...

Were the Following modules infected:

pluginlist

Is this normal?? or is it a virus?? and if a virus I do? I hope you can answer and help me ... thank you very much!
That's because you enabled the "demo" plugin. Now go in and disable it.
Reply With Quote
  #30  
Old 01 Jul 2011, 17:10
MentaL's Avatar
MentaL MentaL is offline
 
Join Date: Jan 2003
I got no infected email just 3 blanks.
Reply With Quote
Reply


Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Mod Options

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 13:23.

Layout Options | Width: Wide Color: