My forum hacked by Tw!sT3R

[spracing]

Hi everyone, recently my forum was hacked and now I can't get to anywhere on the site, ie. admin,etc...

Here is a pic of the opening page

Can anyone help me with what files they have attacked? I'm on version 3.7.2

Thank you very much!

Chris

[R1lover]

Log in via ftp and see which files have been modified....

my guess is the index page and .htaccess. But there could be changes to your database as well.

DO you have a backup?

[spracing]

Unfortunately the only recent backup I have was after it was hacked (from my host) sad but true :(. I was out of town when it happened and didn't see this in time so the backup took place after it was hacked and before I was able to run my own.

Is there anything in those files I should search for that may help me locate the script/code?

Thanks for the quick reply R1lover

Chris

[Brandon Sheley]

You don't have a previous backup?
view the source of your pages, than search in your templates
why can't u login to your admincp?
http://www.forcedinductionforums.com/forums/admincp/

[Extricate]

Also, be sure to check the configuration file (./includes/config.php)
And make sure the hacker did not enter his user ID in there, under specific fields (as in; super administrator, etc.)
Else he'll be able to simply destroy your website again afterwards.

Do you know how the hacker gained access? (As in, FTP; cPanel, etc.)

[spracing]

Loco, since its not a very used forum of mine I don't focus on it too much so sadly I had no recent backups after a bunch of changes, I know :( very stupid on my part.

As for logging in, my password for admin is no longer working so it just keeps sending my to the hacked image when I submit. Is there a way to change the password in the database? I use navicat but it looks like it's encrypted.

Extricate, I checked the config files and don't notice anything out of the norm like a username for super admin.
I'm not sure how they obtained access to the site, I've contacted host monster but they weren't of much help in tracking.

Anywhere else I should look? what kind of text out of the ordinary code lines should I look/search for and where?

Thanks
Chris

[R1lover]

Do you know your userid?

If so set it as the Super Admin and nobody else.... in the config file.

Next if you still can't login then reset your password via phpmyadmin, here an incrypted password for "admin"

replace the password for your account in the user table of the database.

5de5a1e8a825ff8f12693882b2422c2e

Then see if you can login, if you can then change that password via the admin panel.

Next I would re-upload all original vbulletin files. See where you are at from there.

[JamesC70]

Extricate, I checked the config files and don't notice anything out of the norm like a username for super admin.

In config.php, do a search for unalterable user

The result will be the user number(s) of the designated Admin account(s). In a default vBulletin install, this is user #1 and only user #1. (If you know you changed/added this, that's fine. Otherwise, any additional user #s will clue you in as to who may have been involved.)