MyBB Community Forums

Our forum has been hacked and is attempting redirects and saying there is a trojan.
Infection Details
Infection: JS:Agent-PL [Trj]

My antivirus is pointing to javascript files and when I do a file verification from the admin panel it says they've all been changed. Even after a total replacement of them specifically. I'm running the latest version 1.65, Here's a link to the forum. http://mdpreparedness.com/forum/index.php

Any help is greatly appriciated!!

---

Also I have tried disabling all plugins and I have not installed the facebook plugin everyone seems to be having trouble with.

Have you tried re-uploading all of MyBB? What plugins do you use?

If you're using the FB Connect plugin it has a known security hole (XSS vulnerability)

Okay so I went ahead and replace all the files, no joy. The I was seeing files from Tapatalk come up in the warnings so I deleted the folder and it seems to have taken care of it... I will visit their site and see if I'm out of date or whatever and report back so everyone will know if there's a venurability there or not.

I'm using tapatalk, can you please let me know if you find out if it's at fault.

I have not gotten to the bottom of it yet but the Mobiquo folder was where the trojan was, no question about that. I also have the latest version installed so I'm not sure what the problem is. I am going to replace that folder with a fresh copy and see if it happens again. If so I will send the corrupted one to them to see if they can figure it out....

Do you have the file "tags.php" on your server. If so did it come from a plugin? We've another user who has been hacked via that file, which isn't part of the standard MyBB package.

just checked my Mobiquo folder and i have no files like that inthere at all.

I think Avast started to have false positives. Otherwise it's a new MyBB vuln.

I use Avast and the problem is here:
http://community.mybb.com/thread-111147.html

Despite the JS not being parsed it reports it as one because the code is there. However, MyBB prevents it from being parsed. It's a false positive in my opinion.