Repeated Hacks Since Friday

[joethaman]

So, I've been getting repeatedly hacked over the last few days. I've been hacked in the past, maybe once every month or two. They are getting into my database somehow and changing the templates to their "hacker" pages. I inspected all index files and they are all untouched and only way to repair was to recover the database from an older version.

I tracked down some files that were uploaded to my "signatures" directory yesterday but it is still happening. Went to bed last night and everything was fine and awakened to a hacked board. Yesterday, I changed my pw's for my admin account, changed login and pw for my databases, changed directory login and pw for all control panels (need 2 logins and pw's to get to admincp, etc). Added login and pw for mysqldumper, admincp, modcp, and install directories. Changed cpanel login and pw for domain control panel. Updated to latest patches of all add-ons and vbulletin. I did a diagnostics and viewed all the Suspect File Versions and found nothing out of the ordinary. The only thing I could think of doing today was remove vbadvanced cmps.

Any advice would be greatly appreciated.. The next step I am going to take if it gets hacked again is to delete all files on the server and do a fresh install and restore the database to that install.

The first was from T3eS_hack@hotmail.com or http://www.alboraaq.net/t3es. The ones following the first did not say who it was but i am assuming the same person.