Forum hack please help [Archive]

View Full Version : Forum hack please help

Rizzler

01-13-2014, 04:24 PM

Hello

I had my forum hacked today and the frontpage defaced. Any file i try to go to gives me the hackers message on the front i removed every file on the server and reuploaded them, set the config.php with the database information and also added define('DISABLE_HOOKS', true); into the PHP, now after i did this there was no change, the hackers message is still in the database wich makes me guess that he maybe changed FORUMHOME as suggested when i tried searching google for answers, i can access the database from Phpmyadmin BUT i cannot access the forum adminCP i can access the login windows but when i press "login" it redirects me to login.php wich gives me the hackers message again, what do i do from php my admin to get my forums back online ?

Max Taxable

01-13-2014, 04:40 PM

Link to the site?

If the INSTALL folder still exists on your server, delete it.

Rizzler

01-13-2014, 04:49 PM

The site is over at welikeanime.com and i can go to admincp/ but i cannot login. The installfolder is deleted from the root folder since the install.

Max Taxable

01-13-2014, 04:56 PM

I get nothing but a blank page, there's no code in reading page source.

Rizzler

01-13-2014, 05:16 PM

my stupid host removed the default style in the "style" table in the database when scaning, i tried to restore it it but now i just get blank pages. i have a test forum with another license that also was defaced and the code bellow is on all pages i try to access like login.php index.php or simillair. It was on the frontpage where you also get a white page now but after the problems in the "style" table the page is just white, anything you can figure out?

it's for most .php files in root like if i go to mysite.com/login.php or index.php instead i get the hackers message

Malware:

<html>

<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>HACKED BY Mr.M0R0 MOROCCAN HACKER</title>
</head>

<body>

<img border="0" src="http://stupidwebsite.com/46/95/864954/65130309_p.gif">

 HACKED AND DEFACED BY Mr.MORO MOROCCAN HACKER

 WHAT THE HELL IS GOING ON HERE YOUR SECURITY IS LIKE A SHIT

 ++++ING UNSECURE SERVERS I REALLY HATE IT. NO APOLOQIZE , NO MERCY

 NO PITTY , NO SORRY , BUT DO NOT WORRY NO FILES DELETED ONLY YOUR INDEX

 HAS BEEN CHENGED SO TRY TO EDIT QUICKLY GOOD LUCK . FOR MORE INFO CONTACT ME ON :

 Mr.MoRo@HOTMAIL.FR

  BYE

</body>



</html>

Max Taxable

01-13-2014, 05:20 PM

That's coming from a file on the server, not the database.

PM me with FTP credentials and i will have a look.

TheLastSuperman

01-13-2014, 08:38 PM

It's more than likely this one: http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/4012392-help-both-forum-and-admin-panel-just-show-white-page?_=1387659347561

See post #13

.. If not then it's the other variant where the hacker edits your master style replacing all templates with the same identical code which is rather bothersome as you can imagine :p.

Rizzler

01-14-2014, 10:50 AM

I would like to thank Max Taxable for helping me with this issue, thank you very very much! :)

Max Taxable

01-14-2014, 11:12 AM

I would like to thank Max Taxable for helping me with this issue, thank you very very much! :)I did some PM networking and little else. The party responsible for the actual help is a really good egg.