Site somewhat hacked.

[3lou 55]

Hello guys,

So recently I was using a vbulletin forum, it also has a subscription page, where you can manage subscriptions in the adminpanel.
The file is called subscriptions.php.
But whenever I open subscriptions.php a teamPS hacking injection thingy comes up!
It looks close to this http://www.youtube.com/watch?v=1rFMVtrJrXU
But then green.
I have also restored the subscriptions.php, to check if he played with the codes up there, but he didn't.
Also if I name it subscription.php, it will work just fine.
So WHY am I getting it only with subscriptions.php, and with nothing else.

[ozzy47]

I would follow the links below, and go through them thoroughly.

First you need to follow our advisory about deleting the install folder off your forums.

Then please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked (http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked)

http://www.vbulletin.com/forum/blogs...vbulletin-site (http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site)