OK, so my site got hacked... I think? Advice?!

[FleaBag]

I have a second vB board which I mostly use for testing stuff out... I logged onto it yesterday and found that in some shape or form I've been hacked. The second time in my 12 years or so online... The last time was an old vB2 v3 Articles vulnerability... This test board however, had few hacks installed.

I've Googled for the names on the page but it doesn't yield many results, it seems my page is the only one online hacked in this way.

All vB URL's redirect to the page you can see in the above link, there is an embedded image - which is not actually a file on the server. I thought the FTP had been hacked but I logged in and all files are unchanged since my last upgrade. I then thought .htaccess had been changed in some way, but this is also unchanged...

ACP stuff works fine... So what's going on here? Where has my site gone?

I don't know if this is a vB issue (by issue I mean I left a door open somewhere, rather than an exploit) or server issue... The page does mention Safe Mode being off.

So if anyone could shed any light on what happened, how I stop it happening again and how I get rid of this trash it would be greatly appreciated!?

Oh and can anyone translate what the text on the page says?

The board is/was running 3.7.3 PL1. Thanks guys!

[KW802]

Check your templates to see if any of them have been modified (replaced with the HTML you're seeing instead of the usual vB templates). I came across a site that was hacked where several templates were replaced; everything behind the scenes worked but the templates were replaced. Also be sure, after you've recovered to a point where you can go from, to check your phrases & translations to make sure nothing was added. The site I mentioned with the template changes also had a second language added and some phrases altered.

[FleaBag]

Hi Kevin, thanks for the suggestions...

I must have been tripping last night, as I just tried to log into the ACP and I get the same defaced page on login.php?do=login. So no cookie can be set.

[KW802]

Originally Posted by FleaBag

Hi Kevin, thanks for the suggestions...

I must have been tripping last night, as I just tried to log into the ACP and I get the same defaced page on login.php?do=login. So no cookie can be set.

If you're sure that none of the actual files on the server have been comprimised, then perhaps your admin password has been reset and you're seeing the 'invalid password' error page that has been defaced.

Try resetting your admin password.

[Winterworks]

Do you have two licenses or just one? It all depends on this.

[FleaBag]

Originally Posted by KW802

If you're sure that none of the actual files on the server have been comprimised, then perhaps your admin password has been reset and you're seeing the 'invalid password' error page that has been defaced.

Try resetting your admin password.

Thanks once more. I'll give that a shot now.

EDIT: Kevin I just realised, I need to set up a new account to do this... Which I don't have the ability to do.

Originally Posted by Winterworks

Do you have two licenses or just one? It all depends on this.

What all depends on this?

[Winterworks]

Just answer the question and I can help you?

[FleaBag]

Oh right, I thought you meant there was an issue that only affected licensed boards lol.

Yes it is my friend, and I'm sure I'd be shut down here pretty fast if I didn't.

[Winterworks]

That's not my question It was how many licenses do you have?

[FleaBag]

Oh, right... Sorry I misread the question. I have two at present.