site hacked by lasttouch

[VAG]

<a href="http://www.vagcommunity.com" target="_blank">www.vagcommunity.com</a>

did a full re-install of everything and removed thousands of suspicious files. Blog is up, forum is still not up. How to fix that?
Install folder deleted.

Thanks for your help.

[tbworld]

The following guides and best practices should get you up and running again. Be thorough when using them, and sorry you were hacked.

http://www.vbulletin.com/forum/blogs...vbulletin-site (http://www.vbulletin.com/forum/blogs/michael-miller/3934768-recovering-a-hacked-vbulletin-site)
http://www.vbulletin.com/forum/blogs...ve-been-hacked (http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked)
http://www.vbulletin.com/forum/blogs...vbulletin-site (http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site)
http://www.vbulletin.com/forum/forum/vbulletin-announcements/vbulletin-announcements_aa/3991423-vbulletin-install-system-exploit-vbulletin-4-1-vbulletin-5

[Skivey]

do you do a database backup? I use mysqldumper for that and use perl to create auto daily backups. I also got hacked this week and ended up just restoring. Getting my site back took all of 15 minutes which then allowed me the time to follow all of the same links as above to then fix any holes.

As of now im ok.....

--------------- Added 1382702515 at 1382702515 ---------------

failing that, email the hacker and thank them for finding a hole in your site and ask them for help in fixing it.

[VAG]

I removed all malicious files and did a reinstall of all the software but I still cannot get the forum to work. As I was planning to take it down anyway, might save myself the troubles and shut it all down right now.

[Skivey]

reinstall of the software? so you set up a new database? if its a fresh install i highly doubt it... im guessing this isnt the case as you would still have posts and users. Did you do any backups of your database?

Adding to above, in cleaning ive just found 15 new admins...... and a bunch of new plugins.....

[VAG]

My customer wants the old forum back up and running. So I need to dig deeper. Everything is replaced by the new files and all malicious files have been removed. There is some nasty redirect at http://www.vagcommunity.com/forum/forum.php which I can't replace. So i am asking for your help.
I can access admincp without problems. And sadly, I have no backup of the database..

Anyone?

[Bladed]

Search your database for the code. It's in there and you need to delete it. you'll need to search multiple times to make sure it is gone.

[VAG]

Finally it's fixed :D Thanks for the help. There was some malicious code in the database.

[Skivey]

I use a program called mysqldumper

It does auto backups of each database daily and deletes 3 day old ones. It allows you to upload sql files in excess of 50mb (which is the limit for a lot of hosts) and you can also download all backups.

As I said above, I also got hacked and just by resetting the database from the previous backup I lost 0 posts and threads and got my site back up and working within 5 minutes.

Id suggest you do this also, its a brilliant program.

Matt