Got hacked, please help me trace the source ? Injection ?

[maroceve]

Deleted my message in case people used my vulnerability to hack me again

[sarahk]

A site I admin was hacked on the first and the third of this month and vbGallery was implicated however we have since concluded that vbgsitemap was the real vulnerability. We'll be holding off any gallery work until vB7 is released with it's inbuilt gallery now.

In our case the virus that was loaded was PHP.RSTBackdoor so I suspect that the culprits were promoting a different cause (Egyptian IP promoting a Saudi cause).

We do know that they uploaded malicious files into the Gallery (we didn't have the file types locked down well enough and allowed wmv etc, not just photos) and through them they accessed the database and changed the password of an admin. From the Admin CP they:

sent a broadcast email to all the members to a site with adult images and more viruses. The adult site was hosted by Layered Tech so hopefully they've taken action :)
changed the template to include javascript which installed another virus The vB admin logs were useful in identifying just what they did. Once they had access they gave up on injecting the database and worked with the admincp.

At no time was vB actually looking vulnerable. It was all the third party stuff.

Good luck with the clean up.

[maroceve]

Interesting,

Well i cleaned the dabase...apparently the changes were made to the "template" dbs...site works fine now afeter restore