Want to move from vbulletin questions

bobs409

Active member
Hello all,

I am in the middle of a nightmare with my current vbulletin forum. Please bear with me, I have to start at the beginning so this makes sense to those reading.

I hung onto version 3.7 since letting my subscription run out about '08. Everything ran great until about a month ago when some of my users reported their Norton virus protection was giving them warnings. I too experienced some odd pop ups asking me to install things from microsoft which of course wasn't from them.

Being a car mechanic and NOT a computer expert, I couldn't find anything wrong so figured perhaps the old version was the culprit and it was time to bite the bullet and upgrade to the latest 4.1.3 version. I forked out the $175 and for the first day, it ran good and all seemed like it was fixed. The next day, the virus warnings came back and the occasional pop ups too even while logging into the admin area.

I was back and forth with vbulletins ticket system who couldn't find the problem. I was also back and forth with my webhosts ticket system who also couldn't help.
Bad as that was, a few days later, I started getting page errors on all the forum pages making many features stop working.

Vbulletin & my webhost could not help fix this problem either.

Could it get worse? Yep! 2 days ago, my forum stopped working all together. All I get is a white screen on ALL pages! See it here: http://www.348-409.com/forum/index.php?

There are no page errors but it only loads 4 lines of html as shown in the view page source.
Since this, vbulletin directed me to a page from their faq about white screens and has not offered any other help saying those are the only causes. I went through each the best I could with no success. My webhost is out of ideas as well.

Now, needless to say, I NEED to get my forum back in operation so here I am looking at purchasing new forum software in hopes
that I can get back to business as usual on my site. I have a few "pre-sales" questions:

1) Do you think switching over to your forum software will work given the current situation mentioned above?
2) If yes to question #1, and it ends up not working, do you offer a full refund in this case? I'm still angry about the $175 I just wasted, I would hate to add another $140 to that loss.
3) It's very important to me that ALL the information & posts with attachments from my old forum stay intact. Is that possible with this changeover and if yes, does it create the individual forums and sections my old board had so this info can be found? (I hope that makes sense)
4) Will the member names/passwords all stay intact?
5) Being a car guy and not a computer wiz, will Xen help me and stick with me until this is up and running. There is nothing
more intimidating & frustrating than getting replies from support with techno mumbo jumbo thrown at me that I am somehow supposed to understand. Would I expect them to know how to rebuild a carburetor for a 58 Chevy? LOL

While I do have many years of vbulletin under my belt (from '03-current) I know a little but I'm far from an expert in these matters. In simple terms, will Xen be gentle? LOL

Thank you for reading my novel. I'm at the end of my rope with these problems and just want some peace in my life!

Bob
 
Hi Bob,

I'll answer each one in turn.

1. It's possible that switching will resolve the problem as you will be using a new database and server files, but you ideally need to identify the root problem with your vB installation to ensure it is not server or host related. It's possible that your vB installation has been compromised and some malicious code inserted somewhere.

2. As per 1, I don't think the problem will exist in XenForo if it is related to your vB installation.

3. a vB4 importer is available here - members, forums, threads, posts and attachments will all be imported but please note the limitations: http://xenforo.com/community/threads/vbulletin-4-importer.5726/

4. Yes.

5. Official ticket support is available but most people get support on the forums.

Oh and yes, I can rebuild a 1958 Chevy carb' :D

Hope that helps.
Any other questions, feel free to ask.
 
Hi, and welcome to XenForo, :)

As you already uploaded new files and the problems still occurs, then your DB must contain links to a malicious site.

As much as I would love to have you as a customer, switching to XenForo may not help if you import your existing database. If you have access to phpMyAdmin, find the following topics, and verify there are no questionable links: 2304, and 7440. Also check the last poster for forum 33, and check his user info for the same malicious link, probably in his signature.

My Norton reported the above, so let's start there, :)
 
Burn me if you wish, but Norton AV sucks.

Found out the hard way after it crashed with an update, causing me to have to uninstall, and manually comb my registry for norton related registry keys that were sprawled everywhere. I reinstalled, ran update, had to reboot my machine fifteen billion five hundred and sixty three million three hundred thousand and forty three times, and then got the exact same crash as earlier, with the solution being to reinstall.

I never touched anything by Norton ever since, and my life has been a happy one. Ever since dropping Norton, I manage to benchpress 50 pounds more than before, I manage to smell and taste better, and I got a raise.

Ditching Norton - Step 1 in the course to a happier life. Sign up next week, for our expert lesson: Ditching vBulletin.
 
You can't be sure that switching from VB to XF will solve the problem, but seeing as your host couldn't find a problem it does seem like a problem with VB. But what you can be sure is that the XF community will be here every step of the way to help you out and we'll even be here to help you once it's fixed and running properly.
 
Thank you all for the help.

I'm going to have my webhost look for those files, the last thing we want is for me to go messing around in there, I have enough troubles right now! :eek: :D

I'll reply when I get that taken care of.

Bob
 
Ok, the webhost wasn't interested in helping me do that, said it was beyond the normal scope of tech support. Would happily do it for a fee however. :ROFLMAO:

So, I went in there myself and I figured it out. I just deleted those 2 threads; 2304 and 7440. I found the last poster for forum 33 and checked his signature file but there is nothing there out of the ordinary. This particular member is a regular and would not cause the forum any trouble so if there is something there, he didn't put it there.

If someone with Norton can scan the site again, I'd appreciate it to see what shows up.

Thanks,

Bob
 
It's been a while since I used vB, so I am pretty rusty with it. You didn't need to delete the threads in the DB, but look through the posts belonging to those threads for anything suspicious. I know you wrote that you did have a vB Support ticket opened, but I would like to start at the beginning to try to help resolve this for you.

You can access your AdminCP directly (I tried for your site and the Admin login box appeared). In your browser type in the full URL to the AdminCP, and log-in.

Because I can access the AdminCP, it means to me the problem is within a common vB file, directory, template, or product and plugin.

Disable any and all products and plugins you may have installed:

Admin CP -> Plugins & Products -> Manage Products -> Disable
Admin CP -> Plugins & Products -> Plugin Manager (uncheck all plugins to make inactive)

Can you access your forum index page?

If not:

If you are not using the vB default style, make it default:

AdminCP -> Styles & Templates -> Style Manager. Uncheck all listed Styles and check Default Style. From the Drop Down for the Default Style, select Revert all Templates.

Close your browser. Restart it and clear the browsers cache. Can you now access your forum/index.php?

If not, FTP into your site and upload tools.php and rebuild the Master Style and Style Cache (if I remember correctly - sorry for that).

If still no joy with your site:

Rename /forums directory to /forumbu

Create a new directory called /forum

Upload your vB files there. Doing it this way means no non-vB files will be in the new directory.

Rename the config.php.new file to config.php, and edit it to point to your forums DB.

Does the site load? If not, your DB contains the malicious code and you may need to import from a BU, or start searching through it for the malicious code.

If it still does not work, see my signature below: :)
 
Blackjacket: I'm with a small orange. They've been great over the years so I really can't complain.

Thanks for the help Lawrence.

Much of what you mentioned has been tried. First off, I can get the log in screen for admin area but after logging in, it goes to a white screen.

Prior to the white screens, while attempting to fix page errors with vbulletins help, I was able to disable all plug in's & products. It didn't fix the page errors but the site was still up and running with and without those.

vbulletin did have me upload tools.php and do that step.

On my own, I had the bright idea of uploading a fresh copy of vbulletin hoping it would fix the problem, it didn't or course. :cry:

I did add a style and it was working for a few days so I don't think there is a problem there. ??

I think your last idea (sig line) just might be the answer! :cool: (plus you guys have better smilies!) LOL

Bob
 
Bob, as much as I would like to see you switch to XenForo, I would feel much more comfortable finding the cause first.

What you described in the first post, happened to my vB site a few years ago. The problem was the server my site was hosted on was compromised. After changing all server/site related passwords, I checked each common vB file (showthread.php, index.php, etc.), and a small script was inserted at the bottom of each file. I removed the script from about (IIRC) eight different files and that fixed it. Shortly afterwards I switched hosts, :)

Even though you have re-uploaded each file, and as it only affects your forum directory it still appears that the problem lies within the DB, or the files themselves.

Have you tried installing a new instance of vB in a new directory, complete with a new DB (do not wipe the old one, just create a new one)? I would try that first and see if you can access the freshly installed forum. If you can not, then either you are passing the virus on from your PC as you upload, or your server contains the malicious code. If you can access the new forum, then point the newly installed forum to the original DB. If the problem re-occurs then you know your DB is infected.
 
Well according to my webhost, they feel confident there is nothing on the server doing this. (virus) When I first contacted them, they did a virus scan of all files and found nothing. (that's not to say it didn't miss something)

I did change all my passwords somewhere in the middle of this mess.

To check the files, what I did was compare the file size from the file on the server next to one on my computer on my ftp program. If the file size was exactly the same, I could only assume there was no extra text added.

There was one odd thing I did find. On the main website homepage (not the forum), I found this was added:
<script language="javascript1.2" src="/forum/clientscript/vbulletin_md5.js"></script> I know I did not put it there. Perhaps this is the file that's causing some problems? I have since removed that line of text and it never re-appeared.

I did upload a fresh copy of vbulletin a few times to a new folder so it only contained the vbulletin files, then renamed it "forum" so the forum ran from those but that never helped.

On the database... I'm not sure on how to create a new one but can look into it. As long as I don't accidentally lose my existing one! :eek:

Makes sense what your saying though, I'll see if I can create a new database and take it from there.

Thanks,

Bob
 
I can't believe I'm saying this but I managed to create a new database and do some testing. :)

I did things a bit different than the way you described however. Rather than reupload all the vbulletin files which takes about 30-40 minutes, I opted to just change the config file so it pointed to the new database, then installed a new forum using the old files. I guess I was in a hurry to see if it would work. :D

I was able to get into the forum admin and the forum itself! I then changed back so it was pointing to the old database and it went back to a white screen.

Is this enough to say the database is to blame or do I need to upload a fresh copy of vbulletin and run from that as a better test?

Thanks,

Bob
 
I can't believe I'm saying this but I managed to create a new database and do some testing. :)

I did things a bit different than the way you described however. Rather than reupload all the vbulletin files which takes about 30-40 minutes, I opted to just change the config file so it pointed to the new database, then installed a new forum using the old files. I guess I was in a hurry to see if it would work. :D

I was able to get into the forum admin and the forum itself! I then changed back so it was pointing to the old database and it went back to a white screen.

Is this enough to say the database is to blame or do I need to upload a fresh copy of vbulletin and run from that as a better test?

Thanks,

Bob

I think that the problem may be in the files rather than at the db. Try do as Lawrence suggested above. Install a new copy of vb at a test folder/subdomain, using a separate database. Then export a copy of your live forum 's db and import it to the db of the test forum and see how it will go.
 
I can't believe I'm saying this but I managed to create a new database and do some testing. :)

I did things a bit different than the way you described however. Rather than reupload all the vbulletin files which takes about 30-40 minutes, I opted to just change the config file so it pointed to the new database, then installed a new forum using the old files. I guess I was in a hurry to see if it would work. :D

I was able to get into the forum admin and the forum itself! I then changed back so it was pointing to the old database and it went back to a white screen.

Is this enough to say the database is to blame or do I need to upload a fresh copy of vbulletin and run from that as a better test?

Thanks,

Bob

Great job!, :)

To understand you correctly, you used the same files but pointed to a newly created DB and it worked correctly, and then when you pointed the config back to the original DB it didn't work? If so, then it does appear you have either a script injected (or links), somewhere in the DB. This will explain why your host could not find any malicious scripts on the server.

Do you still have the new DB? If you do, point your vB install back to it for now. I'm asking you to do this so you can check your forum every once in a while to see if it still works correctly. Does your site's IP begin with 65.75? If it is not the first 2 numbers of your sites IP, log in to phpAdmin and select your infected DB. Click search. Type in 65.75. and select all tables to see if there are any matches. If there are, do not delete anything, for now.

If your site's IP begins with those numbers, then we are either going to need to go through your DB manually to look for a suspicious link or script (beer will be required to lessen the pain), or if you have a BU from a time before the problems began you will need to restore that BU. Importing posts into XenForo that has malicious links will only get imported. If it is not a malicious link in posts or in a users profile, then importing your DB into XenForo should fix you up, but we need to figure what is going on first. This must be frustrating for you, and I do not want you becoming more fraustred because infected data was imported into XenForo. :)
 
Yes, that's just what I did.

There was only 1 oddity, the forum was missing the icons and background images for some reason?? Those should have been there, it was going from the files that were already there. Even the admin area had those missing. Not sure what that means. :confused:

It did work however, I even posted a test message. I will set it back up again to test.

My IP isn't the 65.75, that's the site the virus or malware is sent so I will check the DB like you said and let you know my findings.

Thanks,

Bob
 
Ok I checked the database. I found these but most were just myself and the users talking about the malware and virus warnings:

5 matches inside table post (4 are post of us talking about the malware, other post was not discussing the malware???)
7 matches inside table postithistory (these were just of us talking about the malware)
4 matches inside table searchcore_text (just posts of us talking about the malware)

Bob
 
why are we troubleshooting a vBulletin problem?
ali_095.gif
 
Top Bottom