Hacked

Originally Posted by Mert Gökçeimam

vBSEO 3.3.2 does not have the vulnerability

I have to disagree, maybe another way in, but I have the same issue as everyone else and I'm on 3.3.2

Please run the script and reset your datastore when you face the reset warning

I didn't get any errors on the script but I certainly have the issues.

http://forums.alpinezone.com/vbseo_checkplugins.php

Am I running the correct version of the script? Is this because I am on 3.3.2?

Originally Posted by AlpineZone

I didn't get any errors on the script but I certainly have the issues.

http://forums.alpinezone.com/vbseo_checkplugins.php

Am I running the correct version of the script? Is this because I am on 3.3.2?

FYI I did update to the v2 of the script. Same result.

To clarify, the FILE PATCH is only for 3.5+. 3.3.2 and lower do not need to do this. But the exploit was global, as it was attached to JS served by the version checker.

The product clears the datastore out and rebuilds it clearing out any bad data that was injected.

Originally Posted by Brian Cummiskey

To clarify, the FILE PATCH is only for 3.5+. 3.3.2 and lower do not need to do this. But the exploit was global, as it was attached to JS served by the version checker.


The product clears the datastore out and rebuilds it clearing out any bad data that was injected.

OK... sorry for the confusion but when I run the script and it doesn't return any errors but I'm still getting the DB errors; what does that mean? I never had an option to rebuild the datastore from the script.

Could you please open a ticket with ftp/admincp login info so that we can check this further?

I had to shut my forum down with thousands of visitors wondering whats going on since yesterday and after reading through tons of threads and else where on the net I havent found a fix..

I am running Vbulletin version : 3.8.2 and VBSEOO version : 3.3.0

From what I have read you guys say I shouldnt need that fix but I have the same issue with trillions of error e-mails :

Database error in vBulletin 3.8.2:

Invalid SQL:
SELECT * FROM datastore WHERE title='pluginlist';

MySQL Error :
Error Number :
Request Date : Thursday, January 26th 2012 @ 04:07:34 AM
Error Date : Thursday, January 26th 2012 @ 04:07:34 AM
Script : India Broadband Forum
Referrer : India Broadband Forum
IP Address : 163.30.176.9
Username : Unregistered
Classname : vB_Database
MySQL Version :

What am I supposed to do? I have no idea where to reset this datastore if I atall have any...

Would upgrading to vb4.1.10 and latest vbseo sort this out by itself?

I ran the check plugin thing and get this :

vBSEO - Check vB instance for suspicious plugins

Checking datastore pluginslist: OK

---

Checking plugins code

---

Done.


Why do I still get those e-mails when I turn the forum on?

Hello,

from the date in mail message quoted it looks like an old message received from the mail queue (since there wre lots of them you continue recieving emails). Do you get any mails with recent request data/time?

I have turned my forum back on now and not getting any e-mails yet so I guess the problem sorted itself.

@Oleg You guys should start some kind of vbulletin/vbseo maintenance service as well for a charge that would cover issues like these including upgrades and everything... I wouldnt mind paying something like $50-100 a month or even more if I get timely resolutions. Just close new signups when there is a new issue so new people dont just sign up to get the issue sorted and then stop paying... Just let people sign up for say a month or so and then stop it and keep those customers and see how it goes. I am sure many big board owners wouldn't mind paying a good amount of money for such a service.

Please understand that we are a software company, not a service company. While we always try to offer as many services as we can, the focus of our actions are on producing and supporting the software, not systems. It is impossible to 'warranty' something like this, especially in a time critical point. "I paid $50 and i still got hacked!!!" So, we decided it was not in our best interest to even venture in that direction.