VBulletin attacked

[smartcooky]

TO TRF admins

Just got this message from the Admin at rugbyrefs.com and he asked me to pass it on to anyone who is running a vBulletin forum

[TEXTAREA]Looks like there was a very large attack on VB sites this morning, luckily I didn't get hit too bad, about an hours worth of clean up.

You might want to let anyone else you know that runs a VB forum/site to check the following:

1, Check no unfamiliar admins
2, Check Control panel log for no unfamiliar activity

If no & no, probably safe, if yes:

1, Ban the user & their IP (Need to get the IP from the CP Logs)
2, Delete the /install folder
3, Search templates for "biz", "derpina" & "iframe" Delete any unfamiliar.
4, Look in all your header templates at the bottom for a weird huge script, if there, delete it.
5, Check plugin manager, look at top for a script called "init_startup". Delete it.

Lastly probably pays to upgrade/Reinstall all your VB files to ensure no other scripts that have not been found are lurking.
[/TEXTAREA]

 

[TRF_Ezequiel]

Thanks SC.

I will look into it right away

 

[Getofmeland]

Thanks sc, have passed to Geoff

 

[dasNdanger]

I had issues here yesterday (Sat. 14th). I couldn't post or send pms - it happened suddenly. I shut down my computer, restarted, and it was okay for a few minutes, then the problem started up again. I shut down and ran virus scans and spybot and it cleared out some junk and ever since it seems okay. Not sure if it had anything to do with this, or if it was just a problem on my end.


das