vbet security breach

[hotslot]

http://www.hotslot.org/new-member-introductions/


I'm running vbet and 4.0.3

It appears the js virus redirect got in from vbet.

[vBET]

I will check it fast. What virus do you mean and how you suppose it was got from vbet?

[hotslot]

we trying to help you sir.. Obviously It's not your fault! But if You can help find away from this happening again that would be cool.

thank you

[hotslot]

http://www.hotslot.org/new-member-introductions/


I'm running vbet and 4.0.3

It appears the js virus redirect got in from vbet.

Check link above, its pretty obvious on redirect. AVG blocks my browser after that.
http://www.hotslot.org/vbenterprisetranslator_seo.php

[vBET]

I see that your main page is not working correctly - output HTML is cut. What was changed since last time when forum run appropriately?

[vBET]

Check link above, its pretty obvious on redirect. AVG blocks my browser after that.
http://www.hotslot.org/vbenterprisetranslator_seo.php

Yes I see this redirect but didn't found the cause - you wrote about some virus so I thought that you know what you are writing about. Please describe what AVG means?

I'm investigating this issue right now and in logs I see that link which you gave gives strange .htaccess redirect to: /var/chroot/home/content/h/o/t/hotslot/html/vbenterprisetranslator_seo.php
what causes this end URL in browser. I'm wondering right now why vBET never sees member introduction URL... Looks like some redirect happens before, but I do not see it in .htaccess

If you have nay informations which could help - please give it.

[hotslot]

Good question. The forum was fully functional last night. This morning is when it occurred.

[vBET]

we trying to help you sir.. Obviously It's not your fault! But if You can help find away from this happening again that would be cool.

thank you

This is not obvious at this moment - have to be diagnosed first.

[vBET]

Good question. The forum was fully functional last night. This morning is when it occurred.

Ask persons who have access to your forum - you already had issue that somebody removed you files from server. You should limit access there and change all your passwords. We already gave you advice to change FTP password and you ignored it after some files disappear from your server... Please consider again to do that.

Also - as I wrote your main page is not generating appropriately, what is not vBET fault and shows that your whole forum status is crashed. It is possible that those strange redirections are because of your forum higher issue and when you fix your forum issue then everything will work again. Of course this is only possibility, but now I can tell that some issues are obviously not vBET fault.

Do you have any redirections rules set before .htaccess file - on apache configuration level? It seems that redirection happens before vBET rules takes action and this is possible cause of issue. If you do have - please provide those here. At this moment I have no other clue why redirection is made before vBET rule applies...

Also, if you do have backup from yesterday - please consider to use it.

[vBET]

Any feedback to last post? I need any informations you can give me, to help you solve this issue.