malware?

[abqtj]

Hey Joe,

do you know of others on VB getting malware trouble reported?

A few on my site say they are getting this:
Encyclopedia entry: ExploitCVE-2011-3544.A - Learn more about malware - Microsoft Malware Protection Center

 

[BirdOPrey5]

I haven't heard anything but I haven't been active over there since the surgery... Will get back in the swing of things later this week I hope.

 

[rixXJphx]

... Will get back in the swing of things later this week I hope.

Hope so.

You recovering well?

 

[abqtj]

I haven't heard anything but I haven't been active over there since the surgery... Will get back in the swing of things later this week I hope.

Any tips for finding/removing this threat? Or can you steer me in the direction of a website for it?

 

[abqtj]

Joe...I found and deleted a page that got uploaded by the malware somehow. So sort of redirector.

 

[abqtj]

Virus or Maleware URL? - vBulletin.org Forum

Looks like more vb sites are getting this...hopefully someone on there can lend a hand eventually.

 

[BirdOPrey5]

Did you contact urljet?

 

[abqtj]

oh noes

this is worse than I thought

 

[BirdOPrey5]

 

[abqtj]

Someone accessed the control panel using the Administrator user name 6 times in Oct and 1 time in Nov, each time updating, uploading, etc different plug ins (that aren't there anymore...not sure where/why).

Oh, and the Administrator password has been changed

 

[abqtj]

Oh, and the Administrator password has been changed

Joe, or whoever, how can this be fixed?

 

[Justin]

cliff strikes again

 

[BirdOPrey5]

Joe, or whoever, how can this be fixed?

Sorry I thought you meant you changed your administrator password.

Here's what you need to do- make a new account (regular user account)

Upload the file tools.php which is in your DO_NOT_UPLOAD folder of your vbulletin installation files.

Upload it to your admincp directory

Browse to your tools.php file in your browser

This page will allow you to make your new username an administrator

Delete tools.php as soon as you are done...

Now edit your config.php file... If your old admin account was a superadmin and/or uneditable user, remove their userid from config.php and make your new userid a super admin.

Login to admin cp and you can now change the password of the original admin account in user manager.

 

[abqtj]

Sorry I thought you meant you changed your administrator password.

Here's what you need to do- make a new account (regular user account)

Upload the file tools.php which is in your DO_NOT_UPLOAD folder of your vbulletin installation files.

Upload it to your admincp directory

Browse to your tools.php file in your browser

This page will allow you to make your new username an administrator

Delete tools.php as soon as you are done...

Now edit your config.php file... If your old admin account was a superadmin and/or uneditable user, remove their userid from config.php and make your new userid a super admin.

Login to admin cp and you can now change the password of the original admin account in user manager.

Thanks Joe, I'll do that!

 

[abqtj]

Oh...if MY username is already a superadmin and uneditable, can I just do the lower part of that (edit config on down?)

 

[BirdOPrey5]

You need to make sure the hacked account isn't uneditable because if it is you can't change the password.

 

[abqtj]

gotcha

 

[neelandan]

Isn't this a sort of instructions to hack into any Vbulletin site?

OK - providing there is access to the files in question.

 

[BirdOPrey5]

This is in the vBulletin manual which is a public document.

You would already need FTP access, and if you have that you pretty much already own the site.

 

[neelandan]

Gotcha.

I would dribble out bits of that just to look the part I've been painted in - as a sort of uber tech capable of delving into anybody's computer at will.