EMERGENCY - Hacked, please help!!

[findingpeace]

I just got two vBulletin database errors from Vietnam:

mysql_connect() [<a href='function.mysql-connect'>function.mysql-connect</a>]: Access denied for user 'nobody'@'localhost' (using password: NO)
/home/psychopa/public_html/includes/class_core.php on line 317


Now our forum is totally screwed up, every post becomes 10 posts (words are duplicated). The admin log is completely wiped clean (zero entries). Does anyone know of a hack like this? Has our user data been compromised?

Please help me

[ozzy47]

First you need to follow our advisory about deleting the install folder off your forums.

Then please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked (http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked)

http://www.vbulletin.com/forum/blogs...vbulletin-site (http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site)

Also please see these recent security announcements:

vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5 (http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3991423-potential-vbulletin-exploit-vbulletin-4-1-vbulletin-5)
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions (http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3993204-vbulletin-5-connect-security-patches-released-all-versions)

[findingpeace]

Thanks, I run the latest vb4.2 and deleted the install folder a while back. Are there any known exploits for 4.2?

[ozzy47]

Not that I am aware of.

[Lynne]

You may have deleted the /install directory, but have you since looked for:

- rogue admin accounts
- rogue plugins
- edits to your templates in the last month
- edits to your files

(Did you read and go through the steps in the first blog entry that ozzy posted above?)

[jacobin]

My site got Hacked and compromised my server recently that forced me to move to a new server..after the migration, No users can log onto the site ecept with facebook connect. also, we can no longer POST new threads

Any ideas what might have cause that

Thank you !

[tbworld]

You need to follow all the steps given in the above posts. It is not something we can guess at.

https://vborg.vbsupport.ru/showpost.php?p=2448667&postcount=2

However, I am sorry you got hacked. If you have trouble understanding a particular aspect of the post feel free to ask.