IPB 2.1 Anti Virus Tool

[Ehren]

Hey guys,

Matt has made an anti virus tool for IPB 2.1

We're seeing that some people although fully patched are still having iframes inserted into the board wrappers. This is because hackers took advantage of exploits BEFORE they were patched to upload 'trojan' files. These files can be hidden anywhere in your IPB installation (although usually in the style_emoticons/default folder). The hacker is free to come back at any point and get access to your ACP through this trojan file.

With that in mind, we've created a tool based on IPB 2.2's "anti-virus" checker. The tool searches your IPB installation for suspicious files and prints a list of any suspicious files found. If you're not sure of the file, delete it immediately. We've seen files called '00.php' and 'test.php3' but that certainly isn't an exhaustive list.

Download, unzip, upload to your root IPB folder (where index.php is) and run from your web browser.

The tool does not delete any files by default.

http://www.invisionpower.com/download/tool...ol_av_check.zip

If you find any suspicious files, please post the names of the files here. The more information we get on the files used, the better we can protect against this kind of attack in the future.

You can read the entire post here.

[Perry]

Thanks for the post Ghost. Good find, will help alot of people im sure

[Nerve]

Thanks alot Ghost

[Flex]

Man thats real cool,

Bet took alot of work,

Thanks ghost

[Swarainiz]

Anti-Virus.

Well, my board was installed by IPB Staff, So i might run a check.

Thanks ghost + IPS Beyond.

[tomos]

If you upgrade to ipb 2.1.7 , there is an iption to run a/v scans built in the ACP.

[Frenzy]

damn im still stuck with 2.1.6 !

[Perry]

Yes, well, my 3.0.1 Beta version is very advanced Much better than 2.1.X.

[Ehren]

They're bringing out 2.2 next before 3.0, so I dont see how it's possible to have that version

[Frenzy]

yeah i dont even think they have thought of 3.0 lol...

[tomos]

Nop, 3.0 isnt out to my knowoledge.

IPB 2.2 is only out to a very few selected beta testers I think

[Perry]

/me is busted

[Headshot]

Nice

thx