MyBB Community Forums

Full Version: calendar.php hacked
You're currently viewing a stripped down version of our content. View the full version with proper formatting.
Our domain is www.noniindian.com
We have MyBB forum in the url www.noniindian.com/indiannoniforum
This is a new forum with only 2 users.It seems my forum has been hacked , especially the calendar pages.some hacker is posting some unwanted unrelated messagesHuh with heading like FOREX TRADING, FOREX DEMO etc.. This are not appearing in forums and not done by the registered user.some one is doing in from outside as all are showing as separate webpages in my website and the urls involved are
http://www.noniindian.com/indiannoniforu...hp?fbtr=10
like this from bbtr=0 to 40 , some 40 pages are showing different topics in forex trading but the inside text is not related to forex but looks like some junk coded messages.
We are unable to find this pages in my MyBB PHP ADMIN or dont know how to find it and where to find out.Temporarily we have find some solution by disabling calendar feature on the forum and also renaming the calendar.php to different name.Due to this irrelevant pages and that too suspicious content, we have been penalised by google and from the top 5 pages we have gone above 100 or so. please help where this posts or web pages are situated in MyBB and how to remove them and how to prevent this from happening again.We are rather new to phpadmin also so make it simple for us to understand.
Thank you
http://noniindian.com/indiannoniforum/index.php

I don't see any issues at t'all? Besides your calendar.php not being there.

Forex stuff is usually spam. Do you have Guest posting enabled?
Hi btraill,
There is no calendar.php because as we have mentioned in the post, we have changed the name of calendar.php to a different name ccallendar.php and also disabled calendar feature on the fourm.If we leave the file nama as calendar.php then it is showing some 40 different web pages of forex spam as we have mentioned in the original post.we will change the file name to calendar.php so that you can see those pages.check after 5 minutes please.
Changed the file name back again to calendar.php. check the url below
http://www.noniindian.com/indiannoniforu...hp?fbtr=10
What is it CH Modded to? Nobody should be able to write to the calendar.php other than you.

Question, does - http://www.noniindian.com/indiannoniforum/calendar.php redirect you to the Forex Wordpress Blog? Or do you have to click something within the calendar?
The file permission for calendar.php is 644. The calendar.php link on the forum does not redirects to forex pages.but calendar.php page is showing msg "The specified calendar does not exit". I dont know from where it is linked but this pages are appearing in the web under my forum page.please help.
Thanks again
Hi,
on hind sight now we remenber these pages were linked from one of my webpage url
http://www.noniindian.com/0308.php?Action=Webring .
This page was containing all outbound links from my website to related web sites provided by
mysearchexchange programme. But we have removed this suspected links from this url and now it is not linking to the forex pages.But the question is where the forex pages are located , so that we can delete it permanenely as this is still showing in search pages and also in cache pages.
Hi
Waitng for any help.
Thank you.