Got hacked. What now?

[Quarterbore]

I am an idiot...

Just upload the attached file to your server. you will need to change the extension to .php (the file is safe). See if you can run it or if that is redirected somewhere.

[Berethorn]

Originally Posted by Quarterbore

A reminder to everyone that this really is easy to prevent!!!

Tutorial: Using the CRON tab to do daily backups and long term MYSQL archives

Thanks, and no thanks.

No, seriously, I didn't know about automatic backups. That's a great tip!



I disabled plugins as you said, and no change, so at least that's narrowed out.

[Quarterbore]

try uploading that file and see if you still have the problem. If so, then it is not a vbulletin or database issue. You may need to rename it forumdisplay.php to me sure as well.

[Berethorn]

It shows up fine - "I hate hackers" - and I agree with it.

But afterwards I realized I'd already edited my index.php.

http://www.landofrohan.com/forum/index.php?

[Quarterbore]

OK, so you uploaded that file to "forumdisplay.php" and it didn't redirect?

This is important as that confirms this is not some server trick!

----------------------------------

The next thing I would do is make a new database and reinstall the forum software to the new database WITHOUT changing your existing site! You can create a new directory as the new copy can be anywhere as you really just need the database. You will need to install the same version you are running now so if you are running 3.6.11 don't install a 3.7.x or you will get errors.

Once it is installed and running, then go to the config file of the hacked forums and change the config file to have it look at the NEW database.

If you don't get this problem, then the issue is certainly in your database!

[Berethorn]

Yes, I uploaded it as forumdisplay.php. No redirect. No server trick.

Okay, I'll try that. Meanwhile, if it IS a problem with the database, where is it likely to be? I know the possibilities are endless, but... i have searched the database quite a bit already but it's a big place.

Thanks for all your help, eh?

[puertoblack2003]

Originally Posted by Berethorn

Yes, I uploaded it as forumdisplay.php. No redirect. No server trick.

Okay, I'll try that. Meanwhile, if it IS a problem with the database, where is it likely to be? I know the possibilities are endless, but... i have searched the database quite a bit already but it's a big place.

Thanks for all your help, eh?

in db start from the last and work your way back..its easier that way. which i've done just my .2

[Quarterbore]

Originally Posted by Berethorn

Yes, I uploaded it as forumdisplay.php. No redirect. No server trick.

Okay, I'll try that. Meanwhile, if it IS a problem with the database, where is it likely to be? I know the possibilities are endless, but... i have searched the database quite a bit already but it's a big place.

Thanks for all your help, eh?

You said you have a backup from January, restore that to a new database and change your config file to point to the new database and see if you are still redirected. If you are, then the problem is not the database but something they slipped into a file somewhere.

[snakes1100]

There is no need to use a backup, this is a database driven hack, you need to start searching for phrases he has on that page in your DB, use phpmyadmin, thats fixable, after you find it all, start upgrading your forums & plugins.

[Lynne]

I just wanted to add..... he got onto your site somehow and he will do so again unless to 'fix' the hole in your security. You may need to be talking to your host to help figure out how he got in.