Hmm, it seems that my testsite is functioning correctly - which was currently undergoing testing for 1.6.
It is functional, so the easiest way to fix this seems to be to upgrade to 1.6 ahead of schedule.
Wish I could hunt down the hacker b@sta@rds.
Thanks for all your help guys
My board was running 1.4.14 and got hacked and our test board which was 1.6 also got hacked. The Javascript loads some nasty trojan on your computer so make sure to remove all weird files in the AppData folder as the trojan tries loading DLL's on Startups.
Read
http://mybbrunway.com/forums/thread-479.html for help with removing the virus if you got infected.
For some reason it hasn't worked.
I uploaded the 1.6 files, upgrade went fine, but it still isn't working!! Javascript is still not working etc.
Any suggestions would really be appreciated.
Cheers
DoN
I can't, the "option" field in the AdminCP is not working.
I think that might fix it, as on the testsite all the templates had been reverted or amended to work with 1.6.
How do I do this is if the option box does not work?
Cheers
(2010-08-17, 10:06 PM)Disciple of Nagash Wrote: [ -> ]I can't, the "option" field in the AdminCP is not working.
I think that might fix it, as on the testsite all the templates had been reverted or amended to work with 1.6.
How do I do this is if the option box does not work?
Cheers
You still have the effected files on your host and your probably spreading the trojan to all you members. Replace the jscript folder with a clean copy as all those files are infected. Than change all your FTP information and tell your members to run a virus scan.
The JS codes were intersected in the index.php's of my WordPress and MyBB. They were also in all the scripts located in jscripts/
You should check your <adminfolder>/jscripts/ files as well. Those were probably infected.
Hey guys,
All up and running now.
I managed to get the javascript running in Firefox to revert the templates. Turns out there was something in the templates. I deleted my custom theme, reverted the default. Then I imported the theme from my testsite which was running fine and it worked.
Would love to know how they altered my templates.
I have changed my login and also FTP details - I have also made sure I am using a secure SFTP connection now as well!
If there are any more recommendations on how to make my site more secure I would really appreciate them.
I have also advised my members to check for those files Bob - thanks for the heads up.
Here's something I'd do if I were you.
Download all files to a local folder.
Open NotePad++ and use its search feature to search for ".ru" inside the folder. It will search all files - that way you can know that things are fixed.
Excellent idea!
I am downloading the full directory now anyway, as I thought as it seems to be "clean", that if it happens again I can use it to replace the corrupted files.