Register Members List Search Today's Posts Mark Forums Read

Reply
 
Thread Tools
  #1  
Old 05 Nov 2019, 16:50
MrHorror MrHorror is offline
 
Join Date: Nov 2010
Question Malware issue

Hi. So we are running a vbulletin 4.1.10 forum. We recently had some malware issues. I found two plugins marked vbulletin with long strings of code in the admin cp area. Deleted both of those. Also scrubbed the board for any html code in post replies, threads, etc. However, we still have an issue with popups appearing on the board whenever you click around.

The popups are originating from a site called deloplen.com. A cookie marked deloplen.com also appears in the cookies list in google chrome whenever you visit the board. So now that I've scrubbed the board, I need to know where else this malicious code might be hiding.
Reply With Quote
  #2  
Old 05 Nov 2019, 18:13
Dave Dave is offline
 
Join Date: Jun 2010
Real name: Dave
It's really hard to say from our side what you need to do to get rid of it since the malware can be very well hidden on the filesystem or database (injected into plugins, hooks, templates or language strings).
__________________
https://technidev.com - security, development, exploits, vBulletin
dave[at]technidev[dot]com

Contact me for custom vBulletin 3/4 work & server/website management.
Reply With Quote
  #3  
Old 06 Nov 2019, 01:01
MrHorror MrHorror is offline
 
Join Date: Nov 2010
So here's what I did. I uploaded a backup database from June, deloplen.com cookie still existed. So I deleted all my vbulletin files and did a fresh upload of my forum folder from June. Deloplen cookie still exists. Not sure what to do next.
Reply With Quote
  #4  
Old 06 Nov 2019, 01:34
Dave Dave is offline
 
Join Date: Jun 2010
Real name: Dave
When I Google "deloplen", I only find results that indicate it's an infection on your browser/PC, not malware in the software itself. I'd try a full system scan with Malwarebytes to be sure.

See https://www.pcrisk.com/removal-guide...com-pop-up-ads
__________________
https://technidev.com - security, development, exploits, vBulletin
dave[at]technidev[dot]com

Contact me for custom vBulletin 3/4 work & server/website management.
Reply With Quote
  #5  
Old 06 Nov 2019, 03:30
MrHorror MrHorror is offline
 
Join Date: Nov 2010
Question

I only run into this cookie on our vbulletin forum though. Nowhere else. It's exclusive to the forum only. I've visited other vbulletin forums just to make sure. The cookie only appears on our forum. I have a question though. Is there any way to sever the connection between the cookie and our forum using a code in .htaccess file or something similar? There has to be a way to block a specific url or specific cookie from the forum entirely right?
Reply With Quote
  #6  
Old 16 Nov 2019, 01:55
x iJailBreak x's Avatar
x iJailBreak x x iJailBreak x is offline
 
Join Date: Jan 2011
Originally Posted by MrHorror View Post
I only run into this cookie on our vbulletin forum though. Nowhere else. It's exclusive to the forum only. I've visited other vbulletin forums just to make sure. The cookie only appears on our forum. I have a question though. Is there any way to sever the connection between the cookie and our forum using a code in .htaccess file or something similar? There has to be a way to block a specific url or specific cookie from the forum entirely right?
If you've replaced all files with clean ones and restored the database, try switching out your cookie prefix in config.php and while it won't delete the cookie, it *should* stop it functioning with your site.

If this doesn't work, you likely have another plugin that has been modified that is running the malicious code.
__________________
Professional web developer & sysadmin. Former bad man.
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 12:24.

Layout Options | Width: Wide Color: