Site Hacked - Added Unknown Plugin

[airplane-dude]

Hi all,

My forums have been hacked.. I had an unknown plugin installed, and deleted.. and it's added re-directs and virus to my forums. Any ideas on how to 'clean' it? There are no unknown plugins on my forums now, but my admin log shows some bad activity:

ID User Name Date Script Action Info IP Address
40004 admin 15:18, 28th Dec 2012 plugin.php
40003 admin 15:18, 28th Dec 2012 plugin.php kill plugin id = 49
40002 admin 15:18, 28th Dec 2012 plugin.php delete plugin id = 49
40001 admin 15:18, 28th Dec 2012 plugin.php
40000 admin 15:11, 28th Dec 2012 plugin.php edit plugin id = 49
39999 admin 15:11, 28th Dec 2012 plugin.php update plugin id = 49
39998 admin 15:11, 28th Dec 2012 plugin.php edit plugin id = 49
39997 admin 15:11, 28th Dec 2012 plugin.php modify
39996 admin 15:10, 28th Dec 2012 template.php search
39995 admin 15:09, 28th Dec 2012 attachment.php types
39994 admin 15:09, 28th Dec 2012 attachmentpermission.php
39993 admin 15:08, 28th Dec 2012 image.php upload Avatars
39992 admin 15:07, 28th Dec 2012 plugin.php
39991 admin 15:07, 28th Dec 2012 plugin.php update plugin id = 49
39990 admin 15:07, 28th Dec 2012 plugin.php edit plugin id = 49

Any help would be appreciated.

[borbole]

If I were you I would revert to the most recent backup prior to being hacked. Another thing would be to do a thorough check up of your server space for any backdoor files and the likes and overwrite all your forum files with a fresh set from a new vb package your forum version. Also it would be best to contact your host and to ask them to check their access logs for around the time of the hack to see if there will be any info as to how they got in.

P.s. What version of vb are you using btw? If you are not already using the latest version, it would be best to upgrade your forum a.s.a.p.

[Carnage]

the plugin probably edited some templates directly to put the redirect code in. If you don't have any recent backups, I'd suggest looking at the templates (maybe reimport your styles)

[airplane-dude]

Very is latest of 3.8.X (I posted this in the wrong section I guess, sorry)..

I will admit, my latest backup was quite sometime ago..

Is there a way to revert to the default templates?

[Lynne]

Upload tools.php to your /admincp and point your browser to it > login > Rebuild Master Style

Then create a new style with no parent:

• Styles & Templates > Style Manager > Add New Style
• Parent Style: No Parent Style
• Title: Default vBulletin
• Allow User Selection: Yes
• Save

Then browse the site using that totally default vbulletin style - do you still have the same problem?

[airplane-dude]

Does doing the above get rid of the color schemes and look of the forums?

Can I save those colors and such, somewhere?

[Max Taxable]

Originally Posted by borbole

If you are not already using the latest version, it would be best to upgrade your forum a.s.a.p.

The version matters not at all if it's backdoor exploits installed by the admin via a style template. (Or any mod with such.)

[Lynne]

Originally Posted by airplane-dude

Does doing the above get rid of the color schemes and look of the forums?

Can I save those colors and such, somewhere?

Rebuilding the Master Style will not touch your color schemes or modified templates unless you did something really strange and modified the master style instead of just creating and modifying a new style (very rare). You can always export your style first via Styles & Templates > Download/Upload Styles if you think you may have done that. Again, you would have needed to be in debug mode to do that in the first place which would be very rare for a regular vbulletin user.