We got hacked!!
 

forums.uktotty.co.uk was hacked today at around 18.00
I have lost the index page and I am not sure about the rest, I cannot access the admin page as I get the same index page.
Can I restore this site, has anyone else been hacked today by DR TAIMAR?

Restore the vBulletin index page, and the other vBulletin files. Then if your version is out of date, upgrade it. If such stuff still doesn't work, I'm not sure what to do, since I am lucky enough to have no hacking problems to deal with. Sure, mass spam problems, DDOS type stuff, but none of that. Hope you can fix this.

do you have backups of all your files? I would reupload them all. I'd also try to figure out how it was that they hacked you because if you don't figure that out, they will just do it again.

my admin is away so simple tasks like restoring the index page are a little tricky, where is the back stored? Or should I have done a manual back up every day?

i would say everyday is a little ott but you should try and make a backup at least once a week.
i can deffo help you out if you wish with the files aand help until your main admin techie comes back .

Cheers reecy
Will send you a PM

Russ

--------------- Added [DATE]1203017439[/DATE] at [TIME]1203017439[/TIME] ---------------

Hi guys if anyone can help it would be appreciated, my hosts have no blocked MY IP Addy so I cant get on the site to change the site or infact to tell them they have blocked me!
Can anyone fix the index page for me?

BUMP!

We are still hacked can anyone help?

Your host blocked your IP?! Why on earth would they do that? Phone them or email them and get it unblocked...you can't do nothing if they are preventing you from visiting the site. Else wait till your other Admin gets back.

I can get onto your site and the main index page is fine. It's the forumdisplay page which is hacked. What exactly have you done so far to fix this? Have you restored all the original php files? Have you put up a backup of your database? What have you done?

Hi Lynne I have done a full back up and restore but the site is still hacked after you login or click any links.
is it worth going to an earlier backup or is the redirection actually sitting in the file system?

ask your host to restore a backup if possible (before the hack occurred)

disable all products/plugins once you log in

I would replace the files also. But also look for any suspicious files in your system (you can do that in Admin CP > Maintenance ).

sorry if this is a stupid question: When did you create that backup, before or after the site was hacked?

did you even revert your templates?

Backup was done by cpanel automatically, daily, weekly and monthly, I did the weekly restore within 7 days of the hack.

Thanks for the offers of help on this from everyone, we will be sorting it out soon. :)

I like to gather the hacked files together, tarball them and send them to the host just so they have a record that it wasn't me that sent out those 10,000,000 emails haha. Anyway if you keep regular backups you only lose as many days of posts as your backup period is long, so it's usually not bad. My only worry ever when someone gets in is that they'll propagate something malicious that I might get in trouble for.

hi there, we got our websites hacked yeaterday, can anyone help us to fix the problem, i have done back up before we got hacked, but no ideas what to do next, we will be very grateful for any help

thanks

ahhh,

i got hacked twice couple of days ago by different hackers....after getting hacked second time what i did...was

as i have regular backup of my forum
i restored all backup from cpanel
and then i disabled all hooks
and then upgraded my forum to latest version of vb
and also i used a web scanner to find out the vulnerables and suspicious files.

can you explain how to do that, as we can,t in to do all things you done

thanks

Instead of trying to find suspicious files, you can just remove all the files for your forums, and then reupload a fresh set from a vBulletin zip. Make sure you also reupload any files from modifications.

If these 3 are on the same server, then i would start by making sure the server is secure.