Google Search gives "This site may be hacked"

[NewsArchive]

All,

Google search flags our site as "This site may be hacked". I already
noticed this behavior some months ago (when I clicked on the "SetupBuilder
Community" search link) but thought that someone hijacked our Google search
and paid for it.

Our hosting company pair Networks have completed several scans of our
server, and believe there is some malicious code hidden somewhere in the
vBulletin Board database which is causing this behavior. They never
"hacked" our vBulletin account nor the server.

The vBulletin support guys are working on it and I'll keep you posted.

Friedrich

"Sheep farming is the way to go..."

[NewsArchive]

BTW, this is caused by a newer version of the "redirection issue" that seems
to be infecting thousands of vBulletin sites.

Friedrich

[NewsArchive]

Hi Friedrich -

Sorry this is happening.

Maybe a new domain for your support forum would be good? Even a
separate ISP might be prudent.

vBulletin seems to be causing you some increasingly major issues that
don't necessarily need to be interrelated. These are issues that could
affect your business's livelihood.

Since you don't know when a fix might be made, moving vBulletin might
be something to consider, anyway.

Another quicker thing to consider is temporarily nixing vBulletin from
your system with a sad note that it will be back ASAP.

Jeff Slarve
www.jssoftware.com
Twitter free since Jan 11, 2016
I'll search help files & Google for you.

Grammar troll's, are the worse.

[NewsArchive]

https://i.imgflip.com/ughdv.jpg

>
>The vBulletin support guys are working on it and I'll keep you posted.

Jeff Slarve
www.jssoftware.com
Twitter free since Jan 11, 2016
I'll search help files & Google for you.

Grammar troll's, are the worse.

[NewsArchive]

>
> https://i.imgflip.com/ughdv.jpg
>

<ROFL> Absolutely ;-)

I am knee deep into it right now. Would not have been possible without your
excellent investagation and analysis. I still have no idea how you found
out all this. I am more than impressed :-)

Friedrich

[NewsArchive]

I have manipulated the PHP code a bit and it should not redirect any longer.
But I am afraid this is only a temporary workaround.

IMO, vBulletin are not going to find compromised code.

Friedrich

[NewsArchive]

Seems to have helped, Friedrich.

Jeff Slarve
www.jssoftware.com
Twitter free since Jan 11, 2016
I'll search help files & Google for you.

Grammar troll's, are the worse.

[NewsArchive]

Hi Jeff,

>
> Seems to have helped, Friedrich.
>

Without your absolutely amazing information ("v=422" in your 01_s.txt
analysis file was the key to success) it would not have been possible for me
to find a temporary workaround. I really can't thank you enough for all the
help! THANK YOU!

Friedrich

[NewsArchive]

Aww shucks. You're most welcome.

I am glad it helped.

Jeff Slarve
www.jssoftware.com
Twitter free since Jan 11, 2016
I'll search help files & Google for you.

Grammar troll's, are the worse.

[NewsArchive]

Friedrich, sorry for the pain.
We had a couple of vBulllentin sites that got hacked a few times and we
eventually moved to XenForo. Have been okay for a few years with this
forum software, but suspect its a matter of time. Last month I had a
WordPress site hacked (well it was been used to spam, and then your in
danger of getting black listed). I'm left with the feeling that sql
injection and php web sites are too exposed (especially well known
packages).

>
>>
>> The vBulletin support guys are working on it and I'll keep you posted.
>

John Taylor