Forum hacked

[In Omnibus]

Are you able to login to the AdminCP directly using admincp/index.php?

[Traxdata]

no way,
since I have to enter my pw and when I click on continue...redirecting to this stupid website.

have access only with ftp, phpmyadmin or ssh

Like I said, my other website is not a forum, so no database, has nbothng to do with vbulletin, only .html and .jpg files.
I have replaced ALL .html files and some .jpg but still cant see the pictures and still redirecting active, talked to hoster - nothing suspicious (malware/trojaner) found on server.

[In Omnibus]

Are you able to access the AdminCP using tools.php?

--------------- Added [DATE]1357142189[/DATE] at [TIME]1357142189[/TIME] ---------------

The first thing I would do is to replace the index.php file with the default file. You should be able to do that much via FTP.

[Traxdata]

never tried, do I have to login on tools.php? if so, then no way.

--------------- Added [DATE]1357143095[/DATE] at [TIME]1357143095[/TIME] ---------------

no way, it asks for member# and redirects to another website,

[Simon Lloyd]

It seems to me that one or more of your core files hasn't been overwritten, you will also have a file or two which doesn't belong in your forum root which is rewriting the infection every time it doesn't see it, my suggestion would be to rename your forum folder add a new folder then name it to what your forum folder was, upload all fresh files (with the install/install.php deleted and the config.php.new edited for your database and renamed to config.php) and then try to access, if you can then you need to search your old folder for files that shouldn't be there, delete them, then upload with overwrite via ftp in ascii mode your fresh files in to the renamed folder, rename the temp folder to something else and then rename your old folder back to it's original and see how you go.

[Traxdata]

The problem found, it was also infected .htaccess file in www, I have added one in root but not in www............... shame on me.

. so if one of you will ge the same issue.

But still - it were about 10 infected vbulletin files - you have to delete them, you can easily find them but checking the date - the older and not changed ones are harmful, only recently changed you have to delete and replace with old original files.

The problem came with Filezilla, it seems to be well known problem, I would recommend to login with SFTP and not with FTP if using Filezilla and then changing all the PWs.

--------------- Added [DATE]1357146302[/DATE] at [TIME]1357146302[/TIME] ---------------

Originally Posted by Simon Lloyd

It seems to me that one or more of your core files hasn't been overwritten, you will also have a file or two which doesn't belong in your forum root which is rewriting the infection every time it doesn't see it, my suggestion would be to rename your forum folder add a new folder then name it to what your forum folder was, upload all fresh files (with the install/install.php deleted and the config.php.new edited for your database and renamed to config.php) and then try to access, if you can then you need to search your old folder for files that shouldn't be there, delete them, then upload with overwrite via ftp in ascii mode your fresh files in to the renamed folder, rename the temp folder to something else and then rename your old folder back to it's original and see how you go.

YEs, it was the first I did, I deleted and replaced all recently changed files (.php), all index.html and other .html files, and have created new .htaccess but did not in www, it was such waste of time! I could be ready within 10 minutes.

Database was not effected - thankfully!!! since it could take ages to restore.

[Amaury]

I'd suggest filing a ticket so vBulletin can help.

Also, which version of vBulletin 3 are you running?

[Simon Lloyd]

Originally Posted by Traxdata

The problem came with Filezilla, it seems to be well known problem, I would recommend to login with SFTP and not with FTP if using Filezilla and then changing all the PWs.

Thats possible because filezilla stores your passwords as plain text, however, the passwords will not have been transmitted elsewhere by filezilla but rather you have/had an infection on your own pc that's found and relayed these.

--------------- Added [DATE]1357147387[/DATE] at [TIME]1357147387[/TIME] ---------------

One other thing, if your .htaccess was infected then thats not an issue with vbulletin but more with a server vulnerability as only you or your server control panel can affect the .htaccess.

[Max Taxable]

Originally Posted by Simon Lloyd

Thats possible because filezilla stores your passwords as plain text, however, the passwords will not have been transmitted elsewhere by filezilla but rather you have/had an infection on your own pc that's found and relayed these.

Couldn't thank the post so, thanks here! You are 100% correct.

[Simon Lloyd]

You're too kind , although this is sadly true in so many "i've been hacked" cases, we're all guilty of some security faux pas at sometime or another and only realise it when our world seems like it's caved in!