[redraider]

Originally Posted by shamda

I installed the version of this hack for 3.6.7 when I was using 3.6.7. I decided to uninstall it. I have since upgraded to 3.7.1 and now to the patch 2 of 3.7.1. When I first installed 3.7.0 I created a new template which I use now. I have not installed this hack for 3.7.1.

Now for the problem. Someone is hacking my board. They are somehow taking control of other members accounts and posting threats all over my board. I am not sure how they are doing this. I have gone back and forth with my hosting company and we have sealed up all the security issues we can find. My guess is that the person is somehow using something from the hack to login as user that I had once installed. It seems to be acting just the same way. I have another hack that tells me if more than 1 member logs in from the same computer. Whenever an admin would login as a use with this hack it would trigger the duplicate login alert. When the hacker is taking over an account the same thing happens. I really think he is running something from my 3.6.7 version of the hack. Could this be possible? When I uninstalled it obviously there may be some files that remain on my server? Can anyone help with this?

Have you changed the password for administrators? Also see if he has added himself as an administrator to your administrators group. Check the ip addresses of the administrator and try to block those ips.