so you sure they never got in to his server and up loaded a template over righting the .php?

Well, you can go to forum/memberlist.php and the same header comes up with some vB stuff towards the bottom of the page, so Blaine is prolly correct in that the header template was changed... not sure how Blaine knows for a fact that it wasn't "hacked" tho lol .. hacking includes obtaining access to a site and defacing it (as in this case)..

My guess is it wasnt hacked becuase if it was truely hacked his vbulletin files would be gone.

ok no worrys just checking lol cheers.

I have never updated any new templates or styles, I keep it simple.

So, I tried to revert all templates, to make sure the bad one got reverted. It reported again "nothing to do". So it is not showing an "updated" or "altered" template.

eh.. novis hackers with nothing better to do.. I used to see this daily when I worked at an ISP lol ..

I guess someone could send him a default header template to get him back online at least :D

yes its bullshit, once they have all the tools to do it there is no stopping them lol.

we got a hacker just a few days ago, he messed with only the gobal.php for some reason,

the host got his ip and tracked his isp as being a russian lol.

all i can do is change the pass every day lol.

Found a post on vbulletin.com about this very hacker

http://www.vbulletin.com/forum/showthread.php?t=237018

but reverting did not work for me, I'll just have to wait for the staff to help me out I guess.

Thanks.


Will the original installation files have a default header in it? I think I have them saved on my pc somewhere.

Its also possible that its someone on his shared hosting using a unix command through a php code.