Hi Guys

Thanks everyone for your help.....i had problem in my forumhome template......i reverted that template now its working fine....

If it's the Syrian Army whatchamacallit, they apparently found a way to add themselves as administrators even getting past user moderation/approval (unless someone on my team approved an odd account without telling me).

They hacked NOTICE.PHP and embedded a meta-refresh in the PHRASE table. I don't that it will stop them but I have added the following to my .htaccess

# Block Syrian Army IP Addresses
deny from 5.0.0.0/16
deny from 31.9.0.0/16
deny from 82.137.192.0/20
deny from 91.144.0.0/20
deny from 178.253.64.0/20

These IP addresses are all assigned to a Syrian government ISP (and sharing this list here may tip them off that I have identified which network they came in from).

I am using VB 4.something (still uploading a backup of the actual VBulletin files so my forum is offline at the moment). ADDED ON EDIT: Vbulletin 4.1.5 Patch 1

I don't think changing passwords is going to help with this. They found a flaw in the VBulletin script. I show three actions by the hacker's user account in the ADMINLOG. They are:

ADD action with "notice.php"
UPDATE action with "notice.php"
MODIFY action with "notice.php"

He used a HOTMAIL.IT email address (according to the user account).

He apparently deleted his IP address from the USER record (or when he injected it the IP address wasn't recorded). The ADMINLOG shows the IP address, though.

I'll post more info when I find it.

If anyone knows how they managed to create an admin user account without being approved, I'll be glad to hear about that. Please spare me the "they cracked your password" explanation as that dog won't hunt.

Al souweqah street, Damascus seems to be there going by their ip but I am sure none of the ips are even his real ones. I did see a plugin here that blocks citys or something like that. If anyone has a link plz post it

The IP address is real. The hack started at 19 minutes after the hour and was finished within 9 minutes.

He hit an old thread from 2006 that looks pretty innocuous to me.

It looks like he then hit the upgrade script in the install directory (I know -- I should not have left that there, but I get busy with a lot of tasks on this server).

After hitting the upgrade.php a couple of times and firing off some Javascript he got into the AdminCp.

Once in he executed the newsproxy.php script.

Then he hit the notice.php script.

And then he was done.

--------------- Added [DATE]1378745307[/DATE] at [TIME]1378745307[/TIME] ---------------

I doubt I can shed any more light on this. He got in through an UPGRADE hack and that is all my fault.

I have reverted my forum home template, deleted the install directory and removed the two admin accounts that were created.

Should I be okay after this?

There are no guarantees in life but deleting the accounts and the scripts they used to hack in will certainly make it harder for them to do any more damage.

I also pruned all users awaiting email confirmation, only out of spite, because they were also all obvious forum spammers.

--------------- Added [DATE]1378747182[/DATE] at [TIME]1378747182[/TIME] ---------------

For what it's worth, I had my admins change their passwords but I don't think that was necessary on this one occasion.

That said, the main admin account's password cannot be changed because I blocked that in the INCLUDES/CONFIG.PHP script. That is a prudent measure to take because when they do get in and create an admin account, they can change passwords all over the place. This is the section to update:
Of course, if they could hack into the server account itself they could try to change this script so it's not a perfect protection but it at least serves as a firewall between your legitimate admin passwords and anyone who wants to block you from getting back in.

OK, I'm hacked the same way.
I upgraded all files to 4.2.2.
I deleted the /install directory.
I've searched, and the ONLY two Admin accounts are those of myself and our Editor ...

Still hacked - not sure what else to do? It redirects to the Syrian army thing as soon as you login to the forums or click a thread.

In my case the hacker embedded an HTTP meta refresh directive in new NOTICE.

xenite - can you explain a little more detail - where is that located, and how can I clear it out? I've replaced ALL the forum files on the server, so assume this must be injected into the mySQL?

Login to ADMINCP.

Scroll down to NOTICES (FAQ should be just above it, ANNOUNCEMENTS should be just below it).

Click into NOTICES MANAGER.

If they loaded a notice, you will see it there.