Did you have your install directory still on the site, if you havent removed it already, remove it now.

--------------- Added [DATE]1378345705[/DATE] at [TIME]1378345705[/TIME] ---------------

Its best to htaccess protect your admincp & modcp after renaming them, not using a hack to do it.

I sure did. I only deleted install.php when i installed it, I deleted the whole directory today when someone mentioned it in this thread. Could that have been the problem?

Yes it could have been, to be 100% safe delete the entire directory. Some I've heard have only been deleting install.php and upgrade.php but no official statement yet as to what causes the exploit only a vague announcement and very late email regarding such.

So long as you delete the entire directory as you noted, you won't be subject to the exploit within.

Please note: If at anytime in the future an issue arises such as your admin account messing up or issues with cookies and you need to use tools.php to reset any of it, you will need to re-upload the /install/ directory (do not re-upload install.php or upgrade.php) then run tools.php to sort the issue then promptly delete the entire directory once again. <-- This is only required in the event you need to run tools.php as it requires the install directory to be present.

Hello,

I came to know of this exploit and looks like we too had this attack, we did the below:

1.Deleted install folder
2. Deleted suspicious admin user accounts
4. Refer thread - https://vborg.vbsupport.ru/showthread.php?t=301892 as mentioned there I didn't have any Iframe injection , but there was a line added in the "header" template of one of our custom style that reads as "Kindly delete "install" directory of your forums. Otherwise you will keep getting hacked" and the suspicious lines were removed.

Also we notice that few templates in the custom style has edit history that says "Edited by .." the suspicious admin accounts with time stamp in the past year 2010.

Is there any other precautions that need to be done. Am I currently still exploited? What are the other security measures that I need to do to protect my forums.

Hi everyone,

I am encountering a similar problem forums/forum.php. It seems only forum.php is affected.

This is what is displayed
"DzPhoeniX Here :P | PS :: Don't Mind Just kidding ;) "

Other pages are fine.

If I log in as administrator, forum.php loads correctly.

After some investigations in the admin logs, I found admin users created and logs show this:

https://vborg.vbsupport.ru/external/2013/09/13.jpg
https://vborg.vbsupport.ru/external/2013/09/14.jpg

I have already disabled those accounts but would like to know how to resolve the issue other than a database restore. It seems there could be a plugin or a template edit.

A search for "DzPhoenix" in templates led me to FORUMHOME which was blank except for the line above. I thus restored FORUMHOME back to its original state and everything seems fine again.

Is there anything else I should check on? I'm a bit worried about the references to plugins above and would appreciate any help on this.