Cleaning after hack
 

Ive just deleted about 15 'new' administrators

Any idea what these are?

http://postimg.org/image/5fd9xpgu5/

Matt

--------------- Added [DATE]1382705488[/DATE] at [TIME]1382705488[/TIME] ---------------

this is the contents

http://postimg.org/image/dlzo3jwc7/

--------------- Added [DATE]1382711311[/DATE] at [TIME]1382711311[/TIME] ---------------

I cant seem to see administrator log?

Where should I find this? I can see Moderator Log but not administrator?

Those that make use of the init_startup hook locations are all malicious. Delete them.

Delete all them and the hacker admins then check admin logs see what they have changed I have fixed many forums and have seen them change files in templates and in skimlinks as well

I reuploaded all the forum files so they are now original flles.

As well as this I have deleted all of the above hooks, deleted admins, changed the database name and password, changed the admin and mod cp links. Changed the ftp password, deleted anything 'install'.

Is there anything else I need to do? Do I need to reset users passwords? if so what is the query used to do this?

Regards

Matt

--------------- Added [DATE]1382779442[/DATE] at [TIME]1382779442[/TIME] ---------------

I also notice a few php and html files that I dont recognise..... is there a way of checking all files and folders? Im going to keep the forum down till I get all this sorted....

--------------- Added [DATE]1382779857[/DATE] at [TIME]1382779857[/TIME] ---------------

zdberr9cd964b2da2e416c43c2b2cc5d64ac18.dat

I would do the following, to ensure everything is clean.

First you need to follow our advisory about deleting the install folder off your forums.

Then please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked

http://www.vbulletin.com/forum/blogs...vbulletin-site

Also please see these recent security announcements:

vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions