[ebp123]

The password was not the issue, but i have changed it anyway. It was an SQL injection technique. Somehow they are redirecting my forum home page to a page they created and possibly uploaded on my server themselves. I just cant figure out which file is causing the redirection and how to delete it. My database and website files are intact, im sure they would have deleted all of it if they could.

--------------- Added [DATE]1303107275[/DATE] at [TIME]1303107275[/TIME] ---------------

Originally Posted by frankie.

Your host should be able to log in root WHM and change your cpanel password and email it to you. Once you log in you can check out the .htaccess file, most likely the hacker added something like "DirectoryIndex hackedfile.html" to it so that is why that file loads for your site. I recommend backing up the database as soon as you log in and do a whole new vb install, but link it to your database. (edit the configuration.php) If anything you might had lost files but not the database (posts, threads, text, etc..) Good luck

Thanks for the help. I logged into my cpanel and my my htaccess file shows the following:

# Comment the following line (add '#' at the beginning)
# to disable mod_rewrite functions.
# Please note: you still need to disable the hack in
# the vBSEO control panel to stop url rewrites.
RewriteEngine On

# Some servers require the Rewritebase directive to be
# enabled (remove '#' at the beginning to activate)
# Please note: when enabled, you must include the path
# to your root vB folder (i.e. RewriteBase /forums/)
#RewriteBase /

#RewriteCond %{HTTP_HOST} !^www\.yourdomain\.com
#RewriteRule (.*) http://www.yourdomain.com/forums/$1 [L,R=301]

RewriteRule ^((urllist|sitemap_).*\.(xml|txt)(\.gz)?)$ vbseo_sitemap/vbseo_getsitemap.php?sitemap=$1 [L]

RewriteCond %{REQUEST_URI} !(admincp/|modcp/|cron|vbseo_sitemap)
RewriteRule ^((archive/)?(.*\.php(/.*)?))$ vbseo.php [L,QSA]

RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !/(admincp|modcp|clientscript|cpstyles|images)/
RewriteRule ^(.+)$ vbseo.php [L,QSA]


Does anything look out of the ordinary? Im backing up the database as we speak. Just to make sure I understand correctly, I will need to basically reinstall vbulletin and redo all of the graphics/mods?