my blogs url's have changed...

I am using VBSEO, and i have noticed my BLOG url's have changed.

the other day it was:

http://seoscripts.com/blogs/

now it is:

SEO Scripts Forum - Recent Blogs Posts - Blogs

the blog urls have also changed from full name urls
to something like:

Six Key Steps to Market Your Business Online - Blogs - SEO Scripts Forum

it was something like:
http://seoscripts.com/blogs/seoscripts/rest-of-url/

What is going on?

Hello,

It seems you have been affected by that issue:

config.xml settings changed randomly - security issue?

Please make sure you are using latest vBSEO version, and also make sure your config.xml is set to 644 (or 444, if you are on a shared server) after configuring vBSEO.

Originally Posted by Andrés Durán Hewitt

Hello,

It seems you have been affected by that issue:

config.xml settings changed randomly - security issue?

Please make sure you are using latest vBSEO version, and also make sure your config.xml is set to 644 (or 444, if you are on a shared server) after configuring vBSEO.

I looked at the thread. I am using the latest VBSEO, and it looks like config.xml is set to 644

now the question remains, why did they change, and how do I change them back?

If you were hacked before hand, its possible your password was still available.

Hopefully, you have a vbseo_all.xml back up that you can re-import. And then change all your admin passwords, and lock down your config file.

If you have a vbseo_all.xml file you can restore your settings quickly. But if you don't, please try to set your urls as they always have been.

PM Sent.

P.s: There are a few security tips you may apply on your site:

Easy Security Tips for vBSEO customers

Originally Posted by Andrés Durán Hewitt

If you have a vbseo_all.xml file you can restore your settings quickly. But if you don't, please try to set your urls as they always have been.

PM Sent.

P.s: There are a few security tips you may apply on your site:

Easy Security Tips for vBSEO customers

ok this is weird... no I do not have this vbseo all.xml...

This only affected the blog urls not the forum urls...

so how do I change the blog urls back?

Just go to:

vBSEO CP -> URL Rewrite Settings -> Blog URLs

And then try to set your URLs as they were before you got hacked. You can supply us with example URLs so we can tell you how you have to proceed.

Originally Posted by Andrés Durán Hewitt

Just go to:

vBSEO CP -> URL Rewrite Settings -> Blog URLs

And then try to set your URLs as they were before you got hacked. You can supply us with example URLs so we can tell you how you have to proceed.

now it is asking me to reset the password yet again...
not reset, but select...as if i never set one, and have
already 644 the config.xml

I think I got it...

You said something about checking plugins for base code...I have
a lot of plugins, is there any type of reporting that can be run
to see if any hacker has done any such thing? otherwise as
long as everything runs normally, I may not know unless something
jumps out, or if something goes wrong.

When you are going to change any setting within vBSEO CP, your config.xml file should be writable (chmod it to 666), and when you are done, chmod it again to 644.

Originally Posted by gotlinks

You said something about checking plugins for base code...I have
a lot of plugins, is there any type of reporting that can be run
to see if any hacker has done any such thing? otherwise as
long as everything runs normally, I may not know unless something
jumps out, or if something goes wrong.

You can run this SQL query in your AdminCP to try to find plugins with malicious code:

Code:

SELECT title, hookname, product FROM plugin WHERE phpcode LIKE '%base64_decode%';

title will be plugin title.
hookname will be Hook Location.
product will be the product wich plugin belongs.

With that info you can check within "Plugin Manager" for plugins showing in query results that may contains encrypted code.

Please keep us updated .

Originally Posted by Andrés Durán Hewitt

You can run this SQL query in your AdminCP to try to find plugins with malicious code:

Code:

SELECT title, hookname, product FROM plugin WHERE phpcode LIKE '%base64_decode%';

title will be plugin title.
hookname will be Hook Location.
product will be the product wich plugin belongs.

With that info you can check within "Plugin Manager" for plugins showing in query results that may contains encrypted code.

Please keep us updated .

am I supposed to do this @ Execute SQL Query?

If so, my cp is saying:

You are not authorized to execute SQL queries

my own cp is telling me that admin does not have access.

You should edit your vBulletin config.php file and put your userid on that line in order to run SQL queries within AdminCP:

PHP Code:

$config['SpecialUsers']['canrunqueries'] = '1'; 


1 will be your userid.

You can also do it directly in phpmyadmin on your host platform.

The only thing that I have found out of place so far is my user name keeps logging off the forum
faster and faster, which it has never done before...even when I am in the middle of something,
bamn, I am logged off...and sometimes within min of logging in...

This is what come back on sql query:

MySQL returned an empty result set (i.e. zero rows). ( Query took 0.0014 sec )

Originally Posted by gotlinks

The only thing that I have found out of place so far is my user name keeps logging off the forum
faster and faster, which it has never done before...even when I am in the middle of something,
bamn, I am logged off...and sometimes within min of logging in...

That's a vBulletin related question. Nothing to do with vBSEO.

Originally Posted by gotlinks

This is what come back on sql query:

MySQL returned an empty result set (i.e. zero rows). ( Query took 0.0014 sec )

So you don't have to worry of anything at the moment. Don't forget to apply security tips I mentioned:

Easy Security Tips for vBSEO customers

Please don't hesitate in asking for help if you have any further question.

Best regards.