Site Hacked
 

I logged onto my forum a few minutes ago www.dollhousetvforum.com and it looks like I was hacked. A pop up box appears saying "you niggers got ******".
I'm really not sure what has happened or what to do.

I contacted my host and they basically offered no help.

What should I do?

Thanks

Did you try re-uploading your index.php file?

Yep. No luck.

remove any .htaccess file and make sure you dont have any extra plugins that shouldn't be at global start

Edit the .httaccess or w/e it's called.

I removed the .htaccess file from /public_html/
Still no luck.

My forum is stored in /public_html/dollhousetvforum/ and there is no .htaccess file in there.

I recomend you reupload all your files, and check for mods with security issues. Make sure you are also running the latest vb.

You can put a password require inside php files.

In the process of upgrading from 3.7.0 to 3.7.1 now.
*crosses fingers*

How could they set up this password require without ftp access?

If they have the ftp info wouldn't they have changed the passwords and done more damage?

They dont always change the passwords. They could of also done a file insert cause you have HTML enabled somewhere on your forums. Lots of things can be done.

You should change your passwords.

Also what mods are you running?

Thanks for the info.

Passwords have all been changed.



-------------------


Here is a list of the mods:

Admin Log In As User 3.0 This hack will allow admins to log in as any user.

Automatic Welcome PM 1.0.4 This Hack will automatically send welcome PMs to new members.

Bills PayPal Donate 1.32.366 Bills PayPal Donate

BuRaCH G?lgeli Kullan?c? Ba?l?g? 3.6.x.1.0.0 Sitenizdeki Kullan?c? isimlerini g?lgeli yapar.

Cyb - Advanced 'New Posts' 2.1 Cyb - Advanced 'New Posts'

Cyb - Auto Birthday Greeter 1.3 Cyb - Auto Birthday Greeter

Cyb - ChatBox 1.9.9 Cyb - ChatBox

Cyb - Sub-Forum Manager 2.5 Cyb - Sub-Forum Manager

EzIRC 1.0.3 IRC Chat Addon for vBulletin

Fake Users 1.0.0 Fake Users

Flashchat Integration 3.55 Integration of Flashchat and vBulletin 3.6

Form Hack 4.0 Create a form.

FractalizeR: Registration Form AJAX Enchancements 1.0 Enchances registration form with AJAX

HelpCenter 1.00 RC 1 A Support Ticket System!

Image Resizer 1.0.2 Automatically resizes images in posts!

Inferno vBShout Lite 2.5.0 Real time shoutbox

JustJoin 1.0.0 Just join us

KC - Announcement 1.0.0 Announcements by Kiril Cvetkov

Limited Guest Viewing 1.0.6 Limit guests to view a set number of threads before being locked out.

Members who have Visited 3.7.003 Display members who have visited the forum.

passiveVid 1.1.2 Automaticlly turns video links like youtube, myspace videos, google vidoes into the video players.

PhotoPlog 2.0.7 PhotoPlog: The Lite Gallery

Post Thank You Hack 7.4 Post Thank You Hack

Quick Reply Add On. 3.6.x Add On Editor Tools for Quickreply.

Site Life Status 1.0.4 This will tell you how long your site has been up and running.

Time Greeting 0.06 Changes "Welcome" to "Good Morning/Afternoon/Evening" in the navbar

UA sidebar 3.0.7

Usergroup Color Bar 1.0.0

v3 Arcade 1.0.7 A multiplayer gaming system for your vBulletin forum.

vB News Ticker 1.2 Latest News in a Ticker

vBExperience 3.7.12 Calculate activity of your users

vBExperience Level 2.0 vBExperience Level

Video Gallery 3.0B A video gallery hack that uses Video Sharing sites for hosting.

Yet Another Award System 3.6 2.1.4 Admin can give members awards, and award

ZH - No Avatar 1.0.0 If a member doesn't have an avatar a no avatar image appears

Zoints Profile System 2.1.4 The Zoints client forum profile linking system.

[Sniper] - Mood Manager 1.2.5 Allows users to manage there mood

--------------- Added [DATE]1213544292[/DATE] at [TIME]1213544292[/TIME] ---------------

I am currently updating to 3.7.1 and while uploading files I returned to the index page and the popup authorization box seems to have gone. The IP displayed on the popup authorization was 67.228.190.70

Instead of the page saying "done" when finished loading on the bottom left hand side of the browser, it says "connecting to 67.228.190.70".

hmmm