Database Errors: vbstatistics.....

[froglips]

I'm seeing a lot of error emails from a package vbstatistics.

Given the error occurrence times, I'm guessing someone is trying to use it?

It'd help me track down the errors if you could share what you are working on.

I'm a bit stumped.

Jim

 

[TracyP]

It appeared to me that someone was trying to hack my password, I hope I am reading the email wrong:eusa_naug:eusa_naug

Database error in vBulletin 3.8.2:

Invalid SQL:

SELECT
userfield.*, usertextfield.*, user.*, UNIX_TIMESTAMP(passworddate) AS passworddate, user.languageid AS saved_languageid,
IF(displaygroupid=0, user.usergroupid, displaygroupid) AS displaygroupid,
language.phrasegroup_global AS phrasegroup_global,
language.phrasegroup_vbstatistic_preview AS phrasegroup_vbstatistic_preview,
language.phrasegroup_modpm_title AS phrasegroup_modpm_title,
language.phrasegroup_modpm_text AS phrasegroup_modpm_text,
language.options AS lang_options,
language.languagecode AS lang_code,
language.charset AS lang_charset,
language.locale AS lang_locale,
language.imagesoverride AS lang_imagesoverride,
language.dateoverride AS lang_dateoverride,
language.timeoverride AS lang_timeoverride,
language.registereddateoverride AS lang_registereddateoverride,
language.calformat1override AS lang_calformat1override,
language.calformat2override AS lang_calformat2override,
language.logdateoverride AS lang_logdateoverride,
language.decimalsep AS lang_decimalsep,
language.thousandsep AS lang_thousandsep

FROM vb3_user AS user
LEFT JOIN vb3_userfield AS userfield ON (user.userid = userfield.userid)
LEFT JOIN vb3_usertextfield AS usertextfield ON (usertextfield.userid = user.userid) LEFT JOIN vb3_language AS language ON (language.languageid = IF(user.languageid = 0, 1, user.languageid))

WHERE user.userid = 2032;

MySQL Error : Unknown column 'language.phrasegroup_vbstatistic_preview' in 'field list'
Error Number : 1054
Request Date : Friday, October 2nd 2009 @ 04:29:44 PM
Error Date : Friday, October 2nd 2009 @ 04:29:45 PM
Script : http://www.ncwoodworker.net/forums/vbstatistic_preview.php
Referrer :
IP Address : 12.179.68.234
Username :
Classname : vB_Database
MySQL Version :

 

[froglips]

I'm liking this less and less.....

Best change your password if you haven't already, jsut to be safe.

Jim

 

[Bas]

No need to worry. Your password is not being hacked. The php file in question appears to be part of a malfunctioning module:

vBStatistic Preview Edition contains modules to show several information about your forum and a multifunctional module that shows new registrations, new postings, new threads and online user over a specific period in a pleasing way. This new version of vBStatistic is the follower of the MOTM vBStatistic version 3.0.0. vBStatistic Preview Edition runs with all vB 3.6.x versions

(See http://www.vbulletin.org/forum/showthread.php?t=133015)

I don't think we're using this module today. So, we have two options - fix it, or uninstall it.

 

[froglips]

I was unable to find it in AdminCP.

My fear is something is calling it, or someone.

I checked in Styles/Templates, Plugins, Products, Languages, and Scheduled Jobs.

Very odd, or very simple and I'm missing something.

If no one objects, I can try to remove it on the server.

Jim

 

[TracyP]

Changed it anyway. Got a little nervous seeing my user ID in the

Where user is: 2032 :slap::slap:

 

[froglips]

I'm going to check with Steve. I find both vbstatistic_preview and vbstatistic on the server. They appear slightly different but were installed within a few days of eachother (Dec 21, 2006).

I have renamed the vbstatistics_preview.php, so whatever is trying to access it won't be able to.

Jim

 

[froglips]

I've backed up the scripts and directories, then moved them.

They can be restored from public_html/forums

run the command "tar -zxvf vbstat_100209_bkup.tgz"

I also moved all the related files into a directory public_html/forums/HIDE_vbstatistic/ and did a "chmod 700 HIDE_vbstatistic" to keep it from being accessed.

I'll keep my eyes open

Jim

 

[TracyP]

Just for clarity, I was not insinuating anyone here was trying to hack anything. Thought about my post on the way home.:embarrassed::embarrassed:. I am glad the smart people on the site are on top of it.

 

[froglips]

My insinuometer didn't even blip. :swoon:

Hope this cuts down on inexplicable database errors

Jim

 

[Bas]

I am glad the smart people on the site are on top of it.

What, we have new staff members?

 

[toolman]

What, we have new staff members?

:gar-La;:rotflm::rotflm::thumbs_up:notworthy:

 

[froglips]

Good thing we got in before they added "smart" to our screening process :gar-La;

Jim

 

[froglips]

One last comment. Steve wrote back, he was not aware of any use of vbstatistics in the site.

So, I've gone ahead and removed the HIDE directory.

I moved the tar archives to /home/ncwoodwo/old_files_save/

Thanks,
Jim

 

[Bas]

Sounds good Jim. +1 on making backups, +2 on checking with Steve, and +3 on closing this out.