Question How do I know which alert is real

[stev]

I received hundreds of email alert like this when I turned on vbSecurity today

Greetings,

vBSecurity has detected a security alert regarding config.php Variable Tampering:
$vbulletin->config['Misc']['admincpdir'] changed from 'admincp' to 'http://www.xxx.org/forum/admincp'
$vbulletin->config['Misc']['modcpdir'] changed from 'modcp' to 'http://www.xxx.org/forum/modcp'
$vbulletin->config['Misc']['admincpdir'] changed from 'admincp' to 'http://www.xxx.org/forum/admincp'
$vbulletin->config['Misc']['modcpdir'] changed from 'modcp' to 'http://www.xxx.org/forum/modcp'

The actions you have configured in the Security Center have been taken.

Please log in to your AdminCP and the Security Center: ...... for guidelines on how to correct the issue.

Is there a way to check to see what's going on to determine Vb Sec is not too cautious when giving out arlerts?

 

[Fillip H.]

There is a plugin somewhere that is changing your AdminCP path to the URL. This is incorrect, the URL should not be included in the config.php variable. You need to manually go through all plugins to see if there's any of them that would change the listed variables

All those alerts are real

 

[stev]

Thanks for the answer