[Spangle]

Originally Posted by Jester1423

Ok guys I need serious help. We were hacked and I was able to delete the Admin accounts the hackers added. Looking at the CP log all they changed was the Notice.php But I have no idea were to go to clean up the mess they made. Any help would be great.

www.jeepasylum.com

--------------- Added [DATE]1378993172[/DATE] at [TIME]1378993172[/TIME] ---------------

I figured it out and feel slightly stupid now. Any suggestions on how they might have been able to add admin accounts and how I can prevent this in the future.

First thing you need to do is delete your install folder if you haven't already.

Then you need to run ACP>Maintenance>Diagnostics>Suspect file versions
That will check your VB install for any suspect files, read all the files carefully, chances are they will have created file with .php extensions, check these are what the system is expecting, if it isn't the check will say something like "expected contents not found".

Then you actually need to check to see what is actually in your public_html file, deleted the suspect files, and look out for any you don't recognise, in my installation I found mail.php, password.php, password.txt.

If you are unsure as to what should be there check your downloads for files that go into the root directory.

Then do a check on all accounts that have admin permissions, if they have an IP address, block that address via IPDeny in your C Panel