Mod getting /forum/moderation.php contained the virus "JS/Exploit-Blacole.he
Mod getting /forum/moderation.php contained the virus "JS/Exploit-Blacole.he
|
|
His McAfee web filter came up with /forum/moderation.php contained the virus "JS/Exploit-Blacole.He"
I downloaded moderation.php and scanned it online through all scanners and it came up with nothing. What further action should I take?
Check your JavaScript files (jscripts/) for suspicious code, check moderation templates as well for anything weird. Running the File Verification tool in the ACP may also help you here, as it could uncover a different core file that may be compromised and causing this.
PGP Key (Fingerprint: 23B6 F4C0 FE2D 45AA 61A0 1E86 DB87 09DC DD87 6E40)
I wouldn't know what suspicious code looks like. I'm not a JS programmer. I compressed all jscripts into a .rar and had it checked again on the web (virustotal.com) and nothing came up.
Took a look at changed moderation templates and nothing look odd. I did the file verification tool and it came up with [spoiler] stats.php Changed inc/functions_modcp.php Changed inc/functions_warnings.php Changed inc/mybb_group.php Changed inc/mailhandlers/php.php Changed inc/functions_task.php Changed inc/functions_rebuild.php Changed inc/plugins/hello.php Changed inc/class_bitwise.php Changed inc/cachehandlers/xcache.php Changed inc/cachehandlers/eaccelerator.php Changed inc/class_parser.php Changed inc/class_custommoderation.php Changed inc/tasks/logcleanup.php Changed inc/tasks/threadviews.php Changed inc/tasks/usercleanup.php Changed inc/tasks/backupdb.php Changed inc/languages/english/reputation.lang.php Changed inc/languages/english/showteam.lang.php Changed inc/languages/english/ratethread.lang.php Changed inc/languages/english/akismet.lang.php Changed inc/languages/english/usercp.lang.php Changed inc/languages/english/index.lang.php Changed inc/languages/english/private.lang.php Changed inc/languages/english/moderation.lang.php Changed inc/languages/english/announcements.lang.php Changed inc/languages/english/managegroup.lang.php Changed inc/languages/english/usercpnav.lang.php Changed inc/languages/english/admin/tools_optimizedb.lang.php Changed inc/languages/english/admin/config_post_icons.lang.php Changed inc/languages/english/admin/user_module_meta.lang.php Changed inc/languages/english/admin/config_spiders.lang.php Changed inc/languages/english/admin/config_badwords.lang.php Changed inc/languages/english/admin/config_attachment_types.lang.php Changed inc/languages/english/admin/forum_module_meta.lang.php Changed inc/languages/english/admin/tools_php_info.lang.php Changed inc/languages/english/admin/style_templates.lang.php Changed inc/languages/english/admin/config_module_meta.lang.php Changed inc/languages/english/admin/config_help_documents.lang.php Changed inc/languages/english/admin/home_module_meta.lang.php Changed inc/languages/english/admin/config_calendars.lang.php Changed inc/languages/english/admin/config_warning.lang.php Changed inc/languages/english/admin/config_mod_tools.lang.php Changed inc/languages/english/admin/tools_maillogs.lang.php Changed inc/languages/english/admin/user_group_promotions.lang.php Changed inc/languages/english/admin/config_mycode.lang.php Changed inc/languages/english/admin/tools_backupdb.lang.php Changed inc/languages/english/admin/user_admin_permissions.lang.php Changed inc/languages/english/admin/tools_recount_rebuild.lang.php Changed inc/languages/english/admin/tools_warninglog.lang.php Changed inc/languages/english/admin/tools_module_meta.lang.php Changed inc/languages/english/admin/user_groups.lang.php Changed inc/languages/english/admin/user_banning.lang.php Changed inc/languages/english/admin/home_preferences.lang.php Changed inc/languages/english/admin/config_banning.lang.php Changed inc/languages/english/admin/tools_mailerrors.lang.php Changed inc/languages/english/admin/tools_statistics.lang.php Changed inc/languages/english/admin/config_languages.lang.php Changed inc/languages/english/admin/config_thread_prefixes.lang.php Changed inc/languages/english/admin/config_plugins.lang.php Changed inc/languages/english/admin/home_version_check.lang.php Changed inc/languages/english/admin/home_dashboard.lang.php Changed inc/languages/english/admin/tools_cache.lang.php Changed inc/languages/english/admin/forum_akismet.lang.php Changed inc/languages/english/admin/home_credits.lang.php Changed inc/languages/english/admin/style_themes.lang.php Changed inc/languages/english/admin/forum_moderation_queue.lang.php Changed inc/languages/english/admin/style_module_meta.lang.php Changed inc/languages/english/printthread.lang.php Changed inc/languages/english/search.lang.php Changed inc/languages/english/customhelpdocs.lang.php Changed inc/languages/english/mailhandler.lang.php Changed inc/languages/english/newreply.lang.php Changed inc/languages/english/memberlist.lang.php Changed inc/languages/english/archive.lang.php Changed inc/languages/english/editpost.lang.php Changed inc/languages/english/report.lang.php Changed inc/languages/english/newthread.lang.php Changed inc/languages/english/customhelpsections.lang.php Changed inc/languages/english/syndication.lang.php Changed inc/languages/english/datahandler_event.lang.php Changed inc/languages/english/datahandler_pm.lang.php Changed inc/languages/english/misc.lang.php Changed inc/languages/english/calendar.lang.php Changed inc/languages/english/stats.lang.php Changed inc/languages/english/xmlhttp.lang.php Changed inc/languages/english/forumdisplay.lang.php Changed inc/languages/english/online.lang.php Changed inc/languages/english/portal.lang.php Changed inc/languages/english/sendthread.lang.php Changed inc/class_feedparser.php Changed inc/datahandler.php Changed inc/functions_massmail.php Changed inc/functions_posting.php Changed inc/adminfunctions_templates.php Changed inc/class_timers.php Changed rss.php Changed css.php Changed admin/index.php Changed admin/modules/config/post_icons.php Changed admin/modules/config/profile_fields.php Changed admin/modules/config/warning.php Changed admin/modules/config/module_meta.php Changed admin/modules/config/spiders.php Changed admin/modules/config/thread_prefixes.php Changed admin/modules/config/badwords.php Changed admin/modules/config/attachment_types.php Changed admin/modules/config/mycode.php Changed admin/modules/config/banning.php Changed admin/modules/style/templates.php Changed admin/modules/style/module_meta.php Changed admin/modules/user/group_promotions.php Changed admin/modules/user/module_meta.php Changed admin/modules/user/groups.php Changed admin/modules/user/users.php Changed admin/modules/user/titles.php Changed admin/modules/user/mass_mail.php Changed admin/modules/user/banning.php Changed admin/modules/forum/module_meta.php Changed admin/modules/forum/management.php Changed admin/modules/tools/cache.php Changed admin/modules/tools/module_meta.php Changed admin/modules/tools/tasks.php Changed admin/modules/tools/php_info.php Changed install/images/bullet.gif Missing install/images/content_bg.gif Missing install/images/error_bg.gif Missing install/images/h2-admin.gif Missing install/images/h2-config.gif Missing install/images/h2-createtables.gif Missing install/images/h2-dbconfig.gif Missing install/images/h2-finish.gif Missing install/images/h2-license.gif Missing install/images/h2-requirements.gif Missing install/images/h2-tablepopulate.gif Missing install/images/h2-theme.gif Missing install/images/h2-welcome.gif Missing install/images/index.html Missing install/images/submit_bg.gif Missing install/images/tcat_bg.gif Missing install/images/thead_bg.gif Missing install/index.php Missing install/resources/adminoptions.xml Missing install/resources/adminviews.xml Missing install/resources/index.html Missing install/resources/language.lang.php Missing install/resources/mybb_theme.xml Missing install/resources/mysql_db_inserts.php Missing install/resources/mysql_db_tables.php Missing install/resources/output.php Missing install/resources/pgsql_db_tables.php Missing install/resources/settings.xml Missing install/resources/sqlite_db_tables.php Missing install/resources/tasks.xml Missing install/resources/upgrade1.php Missing install/resources/upgrade10.php Missing install/resources/upgrade11.php Missing install/resources/upgrade12.php Missing install/resources/upgrade13.php Missing install/resources/upgrade14.php Missing install/resources/upgrade15.php Missing install/resources/upgrade16.php Missing install/resources/upgrade17.php Missing install/resources/upgrade18.php Missing install/resources/upgrade19.php Missing install/resources/upgrade2.php Missing install/resources/upgrade20.php Missing install/resources/upgrade21.php Missing install/resources/upgrade22.php Missing install/resources/upgrade23.php Missing install/resources/upgrade24.php Missing install/resources/upgrade25.php Missing install/resources/upgrade26.php Missing install/resources/upgrade27.php Missing install/resources/upgrade28.php Missing install/resources/upgrade29.php Missing install/resources/upgrade3.php Missing install/resources/upgrade4.php Missing install/resources/upgrade5.php Missing install/resources/upgrade6.php Missing install/resources/upgrade7.php Missing install/resources/upgrade8.php Missing install/resources/upgrade9.php Missing install/resources/usergroups.xml Missing install/stylesheet.css Missing install/upgrade.php[/spoiler] 
What version of MyBB are you using?
Random Fish and Sims Maniac
MY PLUGINS Help MyBBSupport help you - remember to mark your threads as solved
I see. It is odd that all of those files are showing as changed; can you reupload : inc/functions_modcp.php and see if it still shows as changed?
Random Fish and Sims Maniac
MY PLUGINS Help MyBBSupport help you - remember to mark your threads as solved
I reuploaded that file and it no longer shows as changed... I wonder if somewhere along the line I upgraded with a partial file package when I should have upgraded with the full package?
Yea, I advise you to reupload the 1.6.18 files.
Random Fish and Sims Maniac
MY PLUGINS Help MyBBSupport help you - remember to mark your threads as solved
Okay Leefish,
Thank you for your advice. I have reuploaded the entire 1.6.18 package... I'm assuming I should not run the upgrade script, so I've renamed the install folder. Everything seems to be operating normally. The changed files now don't show any changed files other than the missing install files as pasted previously. Seem okay? I will have my moderator check if he's getting the same warning as previously. I'm guessing there are two different issues here (files changed, and the virus warning), but perhaps replacing all files has taken care of both problems...? |
|
« Next Oldest | Next Newest »
|
