Inappropriate Spam Private Messages

[Cynette]

Originally Posted by Daniel_LaFleur

I thought I had the same until I looked on the last page of my inbox. It was there, without a title, with a date sent sometime in 1969

I suggest people look there to see if you can delete it.

This worked for me too! Go to the very end of your inbox and see if there is a message there. No subject and was dated 12/31/1969. I deleted it and the 1 unread message disappeared!

[whytheheckme]

Originally Posted by Cynette

This worked for me too! Go to the very end of your inbox and see if there is a message there. No subject and was dated 12/31/1969. I deleted it and the 1 unread message disappeared!

I, on the other hand, marked them as read, just for the nostalgic feel of having PMs from 1969. I bet that very few people will ever have this


Jacob

[Dan Zollman]

Thanks!

[DonRotolo]

D'oh, I already did post in another thread about that 1 unread message - I'll be deleting that momentarily.

Anyway, regarding passwords and security, I posted a whitepaper on the topic which I think is worth reading.

Don

[Brandon Martus]

An update: after some research, this was not a vBulletin exploit. No data was compromised, or hacked. There are multiple other forums experiencing the same PM spam, all reporting that the accounts being compromised had username==password.

I will be resetting passwords on anybody who has username==password, to prevent this from happening in the future. vBulletin will most likely prevent people from setting username==password in future versions, it looks like, as well.

I still have to clean up inboxes -- mine has 2 unread, missing PMs.

EDIT: 117 passwords reset .. and it will perform this reset automatically, every night without notice to prevent future attacks.

EDIT: The private messages should be cleaned up now. Let me know if you still have weird things happening in your PM inbox.

[Elgin Clock]

Anyone still have a bold number X of unread private messages but none in their inbox like I still do?

[Brandon Martus]

Originally Posted by Elgin Clock

Anyone still have a bold number X of unread private messages but none in their inbox like I still do?

A few have reported it .. one person got rid of the bold # by selecting all messages, marking as read. I'll look into it a little this weekend, if I can find some time.

[Richard Wallace]

Originally Posted by Brandon Martus

A few have reported it .. one person got rid of the bold # by selecting all messages, marking as read....

That method worked for me.

[Elgin Clock]

Originally Posted by Brandon Martus

A few have reported it .. one person got rid of the bold # by selecting all messages, marking as read. I'll look into it a little this weekend, if I can find some time.

Originally Posted by Richard

That method worked for me.

Indeed it worked for me as well. Thanks!

[EmptyNerd]

Brandon - My box is showing 1 stored message, but it doesn't show up anywhere to delete. Clicking the "empty box" command doesn't get rid of it.

[kramarczyk]

Originally Posted by EmptyNerd

Brandon - My box is showing 1 stored message, but it doesn't show up anywhere to delete. Clicking the "empty box" command doesn't get rid of it.

Originally Posted by Brandon Martus

A few have reported it .. one person got rid of the bold # by selecting all messages, marking as read. I'll look into it a little this weekend, if I can find some time.

Originally Posted by Richard

That method worked for me.

Originally Posted by Elgin Clock

Indeed it worked for me as well. Thanks!

Yup, me too.

[Starke]

Originally Posted by EmptyNerd

Brandon - My box is showing 1 stored message, but it doesn't show up anywhere to delete. Clicking the "empty box" command doesn't get rid of it.

Same for me!

[Nibbles]

I figured it out, check the checkbox in the header of the table, then in the bottom select "Mark as read". This will force the "unread messages" number in the database to refresh.

Either a SQL DELETE was used to get rid of the messages, or there is a bug in vBulletin which doesn't issue an update after a mass delete (I don't think vBulletin has such a control panel that can delete PMs, last I checked a few years ago).

Anyways, this solution worked for me. That bold "1 Unread message" was driving me crazy too.

[Brandon Martus]

Originally Posted by Nibbles

Either a SQL DELETE was used to get rid of the messages, or there is a bug in vBulletin which doesn't issue an update after a mass delete (I don't think vBulletin has such a control panel that can delete PMs, last I checked a few years ago).

Anyways, this solution worked for me. That bold "1 Unread message" was driving me crazy too.

I deleted the spam PMs manually via sql, but forgot about the cached count that is tied to your user record. I just updated everybodies counts, so the #s should match the messages in your inboxes now.

[whytheheckme]

I liked having messages from 1969 in my PM box! Then I could say to my kids, "Hey kids, when I was your age, CD got attacked, and I have these messages from 1969 to show when Brandon fixed the problem remotely from IRI using nothing but his cell phone, a wad of gum and a paperclip!"


On a serious note, awesome job Brandon fixing everything promptly!

Jacob