Vbulletin support ?

[techy111]

Guys i just checked a latest member user on my site and he's called "supp333" and he's been saved as an Administrator ??????

I'm the Administrator on MY site and i didn't make anybody else Admin !

Has anybody heard of this ? His email is vbulletin support

Is this genuine or a Hacker ?

Please advise....Urgently.

[ForceHSS]

Hacker, vb support would not do that

[techy111]

What am i doing wrong to allow them in ? I have just spent days re starting and re-installing my site as previously my whole database was hacked and i lost everything !!!

--------------- Added 1381788333 at 1381788333 ---------------

And now after trying to ban him i get this.....

"You are not authorized to ban users who are not considered normal, registered users"

[ozzy47]

Did you follow all the items in the following links thoroughly?

http://www.vbulletin.com/forum/blogs...ve-been-hacked (http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked)

http://www.vbulletin.com/forum/blogs...vbulletin-site (http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site)

[techy111]

I was in the process mate , but been on nights for the last 4......any ideas how to ban this user quick ?

[ForceHSS]

looks like they added there user id to the config check and remove them fast then delete them then do what ozzy said above

[ozzy47]

Most likely coming from a plugin, or could be a cron, disable all your mods while doing the above steps.

Open your config.php and below<?php add this line:

define('DISABLE_HOOKS', true);

So it looks like this:
<?php
define('DISABLE_HOOKS', true);
/*================================================= =====================*\
|| ################################################## ################## ||
|| # vBulletin 4.2.2

[techy111]

Config.php has gone missing :(

[ForceHSS]

if site still running then it should be there it is in the includes folder

[techy111]

Found it....name has been changed to configminehaha.php

[ozzy47]

Wow, you really have issues.

[techy111]

Yes mate.....brand new to all this.....having to learn at a crazy pace....so fed up already.

[ForceHSS]

As he has got into your ftp or cpanel change all passwords for both use is http://strongpasswordgenerator.com (set the length to 25 min) also check to make sure he has not made his own ftp account but do change all ftp accounts passwords and htpasswd your admincp as well if you need help with this pm me

[ozzy47]

Stick with it, it can be frustrating going through this on a new set up, but in the end you will enjoy it.