Forum hacked

[psilocybin1]

Someone hacked my forum. In my logs there was access to options.php and changed my admin password and email from a strange ip adress

[Sweeks]

If options.php isnt part of default vbulletin I suggest removing it, run the diagnostics tool for suspicious files on the site :)
________
Nigel Mansell (http://www.ferrari-wiki.com/wiki/Nigel_Mansell)

[Lautaro]

Download your vBulletin files and extract the folder called "Do not Upload" you will find a file named "tools.php" upload it into your 'install'.

Then go to your forum and create a new account if you can and then run the "tools.php" file and reset the admin permission by adding the account you created on the input field.

I hope this helps.

[psilocybin1]

got back in before just wondering how to prevent this

--------------- Added 1245453625 at 1245453625 ---------------

And what is options.php

[Sweeks]

Post a snippet :)
________
Hawaii Medical Marijuana Dispensary (http://hawaii.dispensaries.org/)

[psilocybin1]

Snippet?

[Si...]

Print screen shot... View of the content being... There...

In this case, he is asking you to open options.php up in a text editor. And copy and paste the contents into a reply box... At least I think he means that.

How to prevent this?
Well a number of ways.


Changing your password every X amount of days.
Directory Password Protecting the AdminCP
Setting your ADMIN user from being modified in the config.php
My personal favourate: Rename the AdminCP folder, and telling config.php where and what the new one is, and preform Step 2 on that folder. Then make a blank folder called admincp with a blank index.php in there. [Make sure this AdminCP is passworded too. It pisses hackers off to see a passworded area with nothing in it. Lol!] Remember when doing upgrades to put them in the new folder and ignore the line "Upload AdminCP contents to Admincp on the site" upload it to the personal folder.
Having only one person who is an Administrator.
Having a really long or complex password. My favourate [WHICH IS MY OLD ONE] was "Mary had a little lamb." It had caps, spaces, fullstop/ period, etc.... Simple. But it worked!Those are my suggestions. They worked for me. But hey. What would I know, right? I've been running forum software for over 10 years and never ever been hacked once. Ever.

[psilocybin1]

there was also a style added to my forum called
TRY4G-Team...which leads to a style that shows my directory files

--------------- Added 1245459600 at 1245459600 ---------------

its an exploit style,,,it can access every file aswell as edit save, and upload...BAD NEWS