forum 4.0.1 hacked
 

Hello,

I am working with my provider on my forum that had been hacked by : Saudi Arabia Hacker

My provider put some old backup but it comes back again.

Do someone has an idea what to do?

Thank you

Have a look at your server space for any file or anything out of ordinary. Change all your login info (forum, ftp, cp) and then update your forum to 4.0.2 and see if that would help.

Did your host check their access logs and see how they got in? So the security issues can be patched up.

Thank you for your answer my host (waveweb.com) has been very kind and tried all you said, nothing last longuer than an hour.

I have to say that I have some other forums on the same reseller account, and only this one (ado-causerie.ca) is touched.

I will install the 4.0.2 today and see.

Have a good day.

quick note.. i think 1st thing you should change directory name of your admincp and modcp to something other than standard.. either prefix or suffix it with some weird sequence and update config.php file accordingly..

Well, I succeded to put 4.0.2 and stay ok for 10 hours, now my forum looks like a frame forum, the login is no more possible.

So I have to begin all the process again and I will see how I can do that or my host that is so kind with me (Waveweb.com) will help me.

Thank very much.

--------------- Added [DATE]1266536704[/DATE] at [TIME]1266536704[/TIME] ---------------

I had some template conflits, all seems resolved.

Thank you for your help

im see remote exploit and public (18/02/2010) and work in version 4.0.0 and 4.0.1 but work in version 4.0.2 also :( maybe the bug was not repaired yet

im post here: https://vborg.vbsupport.ru/showthread.php?t=236292

any ideas?

As Paul M said at that other thread, start a ticket at the Custome Area at vb.com.