Ads popping out of nowhere

[GMan55]

Hi all. I was wondering if anyone can provide some insight to this. Since last 2-3 days, I have had several members complain that they are viewing ads in my forum (within the first and last post of every thread). But only a few members can see them and most others cannot. Ad blockers fixed the issue, but I'm wondering how the ads got there in the first place as there was no change done on my part in any way. My forum never had ads before. I would appreciate it if anyone can help me or provide any info. I can't see the ads myself, but some of my members sent me screenshots.

Any help would be highly appreciated.

EDIT:
Oops, I posted in VB3 instead of VB4 section by mistake. My version is 4.1.5

[ShawneyJ]

a link would be a huge help.

[GMan55]

Sorry for the delayed response.

My forum link is:

http://ftazeta.com


Apparently the ads appear on every first post and last post of a thread for some members. I personally can't see the ads at all and have never seen them, so I'm really confused as to what might be causing this. According to those members, the ads only appear on my forum.

Thank you again.

[christon26]

My antivirus blocked your website as a potentially malicious site. You might have been hacked :(

[GMan55]

I figured it out. Someone actually put those ads in (silly me :P)! Disabled and they were gone... it seems we gave an admin account to someone undesired... All is good now and the account has been removed. Sorry about that.

@christon26: Really? Is there any way I can rectify this? But I doubt our forum is hacked. I feel like it could be due to issues with our service provider that we have been having recently.

[vijayninel]

Seems like your forum is hacked and the hackers are putting up their own ads.

[christon26]

It was Malwarebytes that blocked it, I'll have a look at my logs when I get back on my pc :)

[GMan55]

The ads were google ads. This sounds serious, if my forum could have been hacked. Is there any way I can confirm whether or not it has been hacked and how can I drive the hacker out? Thanks for all your help!

[christon26]

I'm sorry, I don't know, I wonder if it's possible that one of the ads may have triggered the Malwarebytes to block?

This is all that shows in the logs:
2012/08/06 07:57:25 +1000 LISSA-PC Lissa IP-BLOCK 79.142.72.93 (Type: outgoing, Port: 52964, Process: firefox.exe)
2012/08/06 07:57:58 +1000 LISSA-PC Lissa IP-BLOCK 79.142.72.93 (Type: outgoing, Port: 52971, Process: firefox.exe)

It blocks that specific IP each time I try to access your site, blocks it in IE too

[GMan55]

OK, my forum has been hacked!!! Someone just made tons of Mods.

Any ideas on how to get rid of them?

[Simon Lloyd]

If you've not edited any core files upload a fresh copy of the vb files via ftp with overwrite in ascii mode (filezilla is great and free!), then make sure you've done all you can to secure your forum and files, make sure you change all admin and database passwords (don't forget to change the db password in includes/config.php too).

[GMan55]

OK, I figured it out. Thanks for all your response. I saw the control panel log and it seems an admin account was hacked into. The same one also created the ads. I have disabled that account and have taken care of it. I have no clue how it was hacked into, but I will do as you suggest and overwrite and probably even upgrade my forum. I have changed all passwords as suggested.

Thank you again!

[Simon Lloyd]

Don't forget when uploading the nfresh files to leave the images out, they're not usually a problem and chances are that you've already added custom pics to the folder. :)

[GMan55]

Will, do, thanks again!