is this "chat od" thing an infection or did you do it on purpose?

dmoney101;573968 said:
that's what we all wanna know
Click to expand...

its an exploit. If you need help fixing it let me know, I've ran big boards before. Here is info

found this searching..
"Finally fixed it. The attacker has just took out the wot.php by injecting code to the startup plugin hook of vBulletin. I'm wondering how he could do that... Was it a vBulletin security breach? Or even he found an insecure code by me? It would be great if the attacker would tell me "
Click to expand...

need to make sure the install directory is deleted, edit out the code, look in the plugins for any plugins with weird names/edits.

look at your "admins" usergroup>primary users and i bet you have one you didnt add... delete him.


"Just a notice to all affected users - delete your /install/ directory!

The "hack" self is sitting in the Pluginsystem, a plugin called "vBulletin" in the "init_startup" hook.
Check also for a user "abdou" who has assigned the Administrators group."
Click to expand...


it will be in the "plugins manager", not the "manage products" section, probably right at top.
 
Last edited:
there is also a scan file you can run from installing off ftp, not in the vbulletin system. it will list all the edited files, look for any you didnt add and then delete them via ftp. ill try to find the file
 
HTML: 
blwwwwww

^^^
the other error (;ine 389 on new posts) is due to html being turned on in the forum which is a bad thing to do in general because people can hijack your forum. there is an error tracker on VB for this problem but if you turn off html it shoudl fix it or..
didnt read this because i wasnt logged in but here is the bug, they say scroll down and ther is a fix i take it.

http://tracker.vbulletin.com/browse/VBIV-15858

on the thread they posted this (this is about newreply.php)

Code: 
Find:

$newpost['htmlstate'] = array_pop($array = array_keys(fetch_htmlchecked($vbulletin->GPC['htmlstate'])));

Replace by:

$htmlstate = fetch_htmlchecked($vbulletin->GPC['htmlstate']); $array = array_keys($htmlstate); $newpost['htmlstate'] = array_pop($array);

or

Add the following line to your config.php under the <?php line:

Code: 
define('SKIP_ALL_ERRORS', true);
 
You must log in or register to reply here.
Help Users

You haven't joined any rooms.

    You haven't joined any rooms.
    Back
    Top