[digif]

Hi,

Recently I've noticed that when I click on the website, popup comes up, even though I never added such ads on the forum.

URL: beneamata.com

How can I find where the code was added and through where did they manage to do that?

Thanks in advance

--------------- Added 25 Jun 2020 at 22:35 ---------------

Ive upgraded version from 3.8.4 to 3.8.9, now there are no more popups, but I wanted to upgrade it to 3.8.11, it got stuck on 3.8.9 with the error:

Database error in vBulletin 3.8.9:
Invalid SQL:
ALTER TABLE adminlog CHANGE ipaddress ipaddress VARCHAR(45) NOT NULL DEFAULT '';
MySQL Error : Table 'elebocom_beneamata.adminlog' doesn't exist
Error Number : 1146
IP Address : IPADDRESS
Username :

Any ideas why?

--------------- Added 25 Jun 2020 at 23:59 ---------------

Ive created the table, everything is now fixed, I've upgraded to 3.8.11, no more malware popups. Thread can go on lock.

[DCD.RB]

It sounds like they might have injected malicious code on the local php files themselves. When you upgraded, you replaced those files with original vB files.

I've seen this happen to wordpress sites.

I'd get your host to review your server to ensure it's not compromised.