Help - my forum has been hacked

[jaxo]

Thanks for that link. Will have a read and see what I can do.. Thanks

--------------- Added [DATE]1378752377[/DATE] at [TIME]1378752377[/TIME] ---------------

From what i can see, they have tried to run scripts and have did something with paid subscription section of the admin panel... every tab I try to access it asks for a password (which I do not know, as I have never set up any paid subscriptions).. where in the files is this password located so I can change or remove it,.. Or is there a quiery I could run to remove it?

What I have did so far is removed the rogue admin, checked config.php to see if any superadmin have been added (which they havent), upgraded my vbulletin to the latest version and renamed the admincp... As far as I am aware they got access through the vbulletin software and not through the server.

Is their anything else I can check for or do ?

--------------- Added [DATE]1378753861[/DATE] at [TIME]1378753861[/TIME] ---------------

Here is a copy of my admin log and what they have done..

25618 N/A 16:06, 8th Sep 2013 subscriptions.php modify 37.130.224.22
25617 N/A 16:06, 8th Sep 2013 subscriptions.php add 37.130.224.22
25616 N/A 16:06, 8th Sep 2013 plugin.php modify 37.130.224.22
25615 N/A 16:06, 8th Sep 2013 plugin.php add 37.130.224.22
25614 N/A 16:06, 8th Sep 2013 plugin.php 37.130.224.22
25613 N/A 16:06, 8th Sep 2013 plugin.php kill plugin id = 677 37.130.224.22
25612 N/A 16:06, 8th Sep 2013 plugin.php delete plugin id = 677 37.130.224.22
25611 N/A 16:06, 8th Sep 2013 plugin.php modify 37.130.224.22
25610 N/A 16:06, 8th Sep 2013 plugin.php kill plugin id = 678 37.130.224.22
25609 N/A 16:06, 8th Sep 2013 plugin.php delete plugin id = 678 37.130.224.22
25608 N/A 16:06, 8th Sep 2013 plugin.php modify 37.130.224.22
25607 N/A 16:06, 8th Sep 2013 plugin.php product 37.130.224.22
25606 N/A 16:05, 8th Sep 2013 diagnostic.php payments 37.130.224.22
25605 N/A 16:05, 8th Sep 2013 subscriptionpermission.php modify 37.130.224.22
25604 N/A 16:05, 8th Sep 2013 plugin.php 37.130.224.22
25603 N/A 16:05, 8th Sep 2013 plugin.php doimport 37.130.224.22
25602 N/A 16:05, 8th Sep 2013 plugin.php files 37.130.224.22
25601 N/A 16:05, 8th Sep 2013 plugin.php files 37.130.224.22
25600 N/A 16:02, 8th Sep 2013 plugin.php modify 37.130.224.22
25599 N/A 16:02, 8th Sep 2013 plugin.php product 37.130.224.22
25598 N/A 16:02, 8th Sep 2013 plugin.php modify 37.130.224.22
25597 N/A 16:02, 8th Sep 2013 plugin.php product 37.130.224.22
25596 N/A 16:02, 8th Sep 2013 plugin.php modify 37.130.224.22
25595 N/A 16:02, 8th Sep 2013 plugin.php add 37.130.224.22
25594 N/A 16:02, 8th Sep 2013 plugin.php files 37.130.224.22
25593 N/A 15:53, 8th Sep 2013 plugin.php 37.130.224.22
25592 N/A 15:53, 8th Sep 2013 plugin.php doimport 37.130.224.22
25591 N/A 15:52, 8th Sep 2013 plugin.php files 37.130.224.22
25590 N/A 15:52, 8th Sep 2013 plugin.php updateactive 37.130.224.22
25589 N/A 15:51, 8th Sep 2013 plugin.php 37.130.224.22
25588 N/A 15:51, 8th Sep 2013 plugin.php update 37.130.224.22
25587 N/A 15:51, 8th Sep 2013 plugin.php add 37.130.224.22
25586 N/A 15:51, 8th Sep 2013 plugin.php add 37.130.224.22
25585 N/A 15:50, 8th Sep 2013 plugin.php files 37.130.224.22
25584 N/A 15:50, 8th Sep 2013 plugin.php modify 37.130.224.22
25583 N/A 15:50, 8th Sep 2013 plugin.php product 37.130.224.22
25582 N/A 15:50, 8th Sep 2013 subscriptions.php add 37.130.224.22
25581 N/A 15:50, 8th Sep 2013 subscriptions.php modify 37.130.224.22