forum 4.0.1 hacked [Archive]

cyberlux

02-16-2010, 07:30 PM

Hello,

I am working with my provider on my forum that had been hacked by : Saudi Arabia Hacker

My provider put some old backup but it comes back again.

Do someone has an idea what to do?

Thank you

borbole

02-17-2010, 10:04 AM

Have a look at your server space for any file or anything out of ordinary. Change all your login info (forum, ftp, cp) and then update your forum to 4.0.2 and see if that would help.

Did your host check their access logs and see how they got in? So the security issues can be patched up.

cyberlux

02-17-2010, 01:37 PM

Thank you for your answer my host (waveweb.com) has been very kind and tried all you said, nothing last longuer than an hour.

I have to say that I have some other forums on the same reseller account, and only this one (ado-causerie.ca) is touched.

I will install the 4.0.2 today and see.

Have a good day.

NiTRoN

02-18-2010, 06:19 PM

quick note.. i think 1st thing you should change directory name of your admincp and modcp to something other than standard.. either prefix or suffix it with some weird sequence and update config.php file accordingly..

cyberlux

02-18-2010, 06:45 PM

Well, I succeded to put 4.0.2 and stay ok for 10 hours, now my forum looks like a frame forum (http://ado-causerie.ca), the login is no more possible.

So I have to begin all the process again and I will see how I can do that or my host that is so kind with me (Waveweb.com) will help me.

Thank very much.

--------------- Added 1266536704 at 1266536704 ---------------

I had some template conflits, all seems resolved.

Thank you for your help

snilabs

02-19-2010, 07:21 AM

im see remote exploit and public (18/02/2010) and work in version 4.0.0 and 4.0.1 but work in version 4.0.2 also :( maybe the bug was not repaired yet

im post here: https://vborg.vbsupport.ru/showthread.php?t=236292

any ideas?

borbole

02-19-2010, 01:24 PM