VBSEO Issues: Possibly hacked?

All,

Having a very weird problem with VBSEO on our forum. A little bit of background first for you guys: We recently upgraded to vB4 and installed a fresh copy of VBSEO. Previously on vB3 we had VBSEO running as well and had zero problems or issues.

Fast forward to the present with vB4 and VBSEO currently on our forum. It runs fine and performs as expected unless there is an attempt to make changes via VBSEO Control Panel. We properly edit the permissions so the config.xml file is writeable. However, once we go into the Control Panel all hell breaks loose. Right away you can see something is wrong as the license key says invalid. However, we confirmed with VBSEO that the license key is in fact valid and the proper one is sitting in the line.

Here is where is get real weird. After any change is attempted in the Control Panel the links to posts and forums on our site go dead. Upon further inspection it was discovered that a vast amount of junk code was being added to the config.xml file when the file is opened to edit.

The junk code starts with:
<name>VBSEO_REFBACK_BLACKLIST</name>
<value><![CDATA[google\\\\

and it keeps going on with about 150 lines of false code.

It's defiantly not a server issue but a some kind of hack. I am really curious as to how this happened as i don't have too many plugins on the forum (all of which are either professional plugins or trusted ones on vbulletin.org) and i feel our security is pretty established.

As for now i am really not sure where to go with this issue. As i stated before it is running fine as we leave it alone, but i would like to go in and make some simple changes. Has anyone every experienced anything like this before? Any ideas for a possible solution?

Any help on the matter would be much appreciated. Thanks in advance for your time

Joey

The refbak black list SHOULD look like that, a list of search engines mostly so that search hits don't record a refback.

Code:

<name>VBSEO_REFBACK_BLACKLIST</name>
<value><=!=[=C=D=A=T=A=[google\..+/(u/|search|blogsearch|custom|pda|linux|ie|ig)|search\.yahoo\.|search\.msn\.|msncache\.com|altavista\.com|answers\.com|ask\.|search\.lycos\.|dogpile\.|alltheinternet\.com|tiscali\.|baidu\.|verden\.abcsok\.no|[/&\?=\.](search|arama|blogsearch|query|results|sok|srch|yandsearch|aolsearch|q)[^a-z-]|backlink_checker\.php|extremetracking\.com|www\.kvasir\.no/nettsok/searchResult|awstats\.pl\?|translate\.google\.com|suchen\.(pl|php|aspx)\?|mail\.yahoo\.com|mail\.live\.com|squirrelmail\/src\/]=]=></value>
</setting>

is the default code block


Are you running mod_Secuirty or suhosin on the server which may eat form input? It looks like your server is adding slashes to stuff that it shouldn't.

this CK editor is such a POS. it ate half of the real code in code tags.

how about an image?