Is Hacking Of My Site Over ???

[lcp03o]

Hi

HAckers got access to my admincp and uploaded a remote shell script http://itsecbiz.blogspot.com/2011/07...f-you-got.html and defaced my site as well as reset passwords for some users.

I have deleted the plugin and I have added extra security on the admincp folder. I have also deleted all files on my server and uploaded the latest 4.1.8 vb files and upgraded to this version.

Am I safe now from the hackers?? Is there any way they could of injected some sort of code in to my database and get access to users passwords via this?? I have deleted all styles on my site and created a new default one.

I have also changed all passwords. Is there anything else I can do??

Thanks

[ForceHSS]

use .htpasswd and .htaccess for admincp, modcp install, includes, packages, and vb folders also rename the admincp and modcp folders

[K!nG]

You can read these steps and see if that's something u wants to do.

Protect the following folders with .htacess: install (it shouldn't b there at all) - admincp - modcp.

Update vBulletin to the lasted version and use only trusted nulled vb versions.

Use a Random Password Generator.

Update Your Server Software APACHE/MYSQL/PHP/etc.

Remove the vB version on the footer and archive

Give only Trusted users High Ranks

Scan your PC of Viruses with a good Anti Virus Like Kaspersky,Anti Vir.

Dont Download every file what someone sends you.

Dont install mods/hacks that are not trusted or modfied by a unknown coder.

Dont use BETA/ALPHA vBulletin versions on a running online site.

Chmod Config Files 777 Rest Files 644

Configure your Server and Update it against known attacks: DDos etc.

Here are few most important changes for php-savvy admins to do (or forum system programmers to initiate) are:

Use a Protected Server network Firewall - Reserve Proxys etc.

unique names for admin control panel on every installation.

unique names for the core member database table on every installation.

unique names for the password field of the member database on every installation.

custom MD5 hashes for posting to the forum to authenticate a logged-in session (prevent spamming and automated posting scripts without using a captcha).

[Max Taxable]

Originally Posted by lcp03o

I have deleted the plugin

What plugin?

[ForceHSS]

Originally Posted by K!nG

You can read these steps and see if that's something u wants to do.


Protect the following folders with .htacess: install (it shouldn't b there at all) - admincp - modcp.

Update vBulletin to the lasted version and use only trusted nulled vb versions.

Use a Random Password Generator.

Update Your Server Software APACHE/MYSQL/PHP/etc.

Remove the vB version on the footer and archive

Give only Trusted users High Ranks

Scan your PC of Viruses with a good Anti Virus Like Kaspersky,Anti Vir.

Dont Download every file what someone sends you.

Dont install mods/hacks that are not trusted or modfied by a unknown coder.

Dont use BETA/ALPHA vBulletin versions on a running online site.

Chmod Config Files 777 Rest Files 644

Configure your Server and Update it against known attacks: DDos etc.

Here are few most important changes for php-savvy admins to do (or forum system programmers to initiate) are:

Use a Protected Server network Firewall - Reserve Proxys etc.

unique names for admin control panel on every installation.

unique names for the core member database table on every installation.

unique names for the password field of the member database on every installation.

custom MD5 hashes for posting to the forum to authenticate a logged-in session (prevent spamming and automated posting scripts without using a captcha).

https://www.vbulletin.com/forum/show...=1#post2231088
you are wrong about the install folder

[Big Al]

I am not a tech and so would not presume to advise on that side of things, but have you considered why some one would go to the trouble of hacking you?

Have you alienated some one recently? A pissed off ex or current member could do many things to a site.

Improving security may not be as effective, if the hacker is motivated by past grievances.

And this issue, if there, may need to be resolved in a reasonable manner as well.

The defacing of a site has to have a reason.
You ask if there is anything else you could do.
I would consider it wise to check if you have upset anyone unjustly recently.

[Breakthecycle2]

[QUOTE=K!nG;2274125]You can read these steps and see if that's something u wants to do.

Remove the vB version on the footer and archive[QUOTE=K!nG;2274125]

How do you remove it? I was under the impression if you did, VB wouldn't work correctly?

[K!nG]

Originally Posted by ForceHSS

https://www.vbulletin.com/forum/show...=1#post2231088
you are wrong about the install folder

Well do ppl really keep install folder after the installation in their forums directory ???? As far as i heard and have seen around no one suggests to keep install folder once ur installation is done. I forgot to type "if u still have it".

--------------- Added [DATE]1322975102[/DATE] at [TIME]1322975102[/TIME] ---------------

[QUOTE=Breakthecycle2;2274429][QUOTE=K!nG;2274125]You can read these steps and see if that's something u wants to do.


Remove the vB version on the footer and archive

Originally Posted by K!nG

How do you remove it? I was under the impression if you did, VB wouldn't work correctly?

Yes, you can remove the version number. To do this, edit the 'powered_by_vbulletin' phrase and replace this:

Powered by: vBulletin Version {1}<br />Copyright &copy;2000 - {2}, Jelsoft Enterprises Ltd.

With this:

Powered by: vBulletin <br />Copyright &copy;2000 - {2}, Jelsoft Enterprises Ltd.

Note: To edit a phrase, place the new phrase in the available language text boxes

You can remove ur version number and its not against vbulletin rules & regulations.

[Max Taxable]

Originally Posted by Big Al

The defacing of a site has to have a reason.

It really doesn't. These script kiddies do it for net "street cred" wherever they find a exploit they know about. It's usually nothing personal against the defaced site at all.

[ForceHSS]

[QUOTE=K!nG;2274478]Well do ppl really keep install folder after the installation in their forums directory ???? As far as i heard and have seen around no one suggests to keep install folder once ur installation is done. I forgot to type "if u still have it".

--------------- Added [DATE]1322975102[/DATE] at [TIME]1322975102[/TIME] ---------------

[QUOTE=Breakthecycle2;2274429]

Originally Posted by K!nG

You can read these steps and see if that's something u wants to do.


Remove the vB version on the footer and archive


Yes, you can remove the version number. To do this, edit the 'powered_by_vbulletin' phrase and replace this:

Powered by: vBulletin Version {1}<br />Copyright &copy;2000 - {2}, Jelsoft Enterprises Ltd.

With this:

Powered by: vBulletin <br />Copyright &copy;2000 - {2}, Jelsoft Enterprises Ltd.

Note: To edit a phrase, place the new phrase in the available language text boxes

You can remove ur version number and its not against vbulletin rules & regulations.

I think you mean the install.php not the whole folder