Got hacked. What now?

[Hornstar]

Originally Posted by Quarterbore

There shouldn't be any base 64 scripts in your forums

What should I do?

Search results for "%base64%" at least one of the words:
2 match(es) inside table vb3_datastore
4 match(es) inside table vb3_plugin
2 match(es) inside table vb3_pmtext
4 match(es) inside table vb3_post
3 match(es) inside table vb3_postedithistory
1 match(es) inside table vb3_postparsed
1 match(es) inside table vb3_word

Total: 17

Example: Table: vb3_word

     SQL query:        SELECT  * 
FROM  `***_***`.`vb3_word` 
WHERE ( `wordid`  LIKE  '%%base64%%'
OR  `title`  LIKE CONVERT( _utf8 '%%base64%%'
USING latin1 ) 
COLLATE latin1_swedish_ci
)
LIMIT 0 , 30

Wordid: 57647
title: base64


Example: table vb3_plugin

     SQL query:        SELECT  * 
FROM  `***_***`.`vb3_plugin` 
WHERE ( `pluginid`  LIKE  '%%base64%%'
OR  `title`  LIKE CONVERT( _utf8 '%%base64%%'
USING latin1 ) 
COLLATE latin1_swedish_ci
OR  `hookname`  LIKE CONVERT( _utf8 '%%base64%%'
USING latin1 ) 
COLLATE latin1_swedish_ci
OR  `phpcode`  LIKE CONVERT( _utf8 '%%base64%%'
USING latin1 ) 
COLLATE latin1_swedish_ci
OR  `product`  LIKE CONVERT( _utf8 '%%base64%%'
USING latin1 ) 
COLLATE latin1_swedish_ci
OR  `devkey`  LIKE CONVERT( _utf8 '%%base64%%'
USING latin1 ) 
COLLATE latin1_swedish_ci
OR  `active`  LIKE  '%%base64%%'
OR  `executionorder`  LIKE  '%%base64%%'
)
LIMIT 0 , 30

$attachpatch_patchfirstpost = array ();
global $foruminfo, $vbulletin;

if (!empty ($vbulletin->options['attachpatch_patchfirstpost'])) {
    $attachpatch_patchfirstpost = preg_replace ('/[^0-9,]*/', '', $vbulletin->options['attachpatch_patchfirstpost']);
    $attachpatch_patchfirstpost = explode (',', $attachpatch_patchfirstpost);
}

if
(
    $vbulletin->options['attachpatch_enable'] 
    AND 
    (
        in_array($foruminfo['forumid'], $attachpatch_patchfirstpost)
        OR
        $vbulletin->options['attachpatch_patchfirstpost'] == -1
    )
    AND
    $post['parentid'] == 0
)
{
    if (!isset ($attachpatchinfo))
    {
        // initialize my variables
        $attachpatchinfo = array ();
        $attachpatchinfo['mycounter'] = 0;    // counts loop iterations
        $attachpatchinfo['combinedfilesize'] = 0;
        $attachpatchinfo['moderatedattachments'] = '';
        $attachpatchinfo['showmoderatedattachments'] = false;
        $attachpatchinfo['visibleattachments'] = false;
        $attachpatchinfo['attachmentids'] = array ();
        $attachpatchinfo['dateline'] = 0;
        $attachpatchinfo['counter'] = 0;    // this is the vB download counter for the attachment
    }

    // count attachments to know the last time we go thru the loop
    ++$attachpatchinfo['mycounter'];

    if ($attachment['visible'])
    {
        // do the necessary stuff from the original loop in the function
        // skip the various built-in vb templates (image/thumbnail etc)
        if (THIS_SCRIPT == 'external')
        {
            $attachment['counter'] = $vbphrase['n_a'];
            $show['views'] = false;
        }
        else
        {
            $show['views'] = true;
        }

        // remember that there is at least one visible (not moderated) attachment
        $attachpatchinfo['visibleattachments'] = true;  

        // add up total filesize of non-moderated attachmentes
        $attachpatchinfo['combinedfilesize'] += $attachment['filesize_real'];

        // save the attachment ids, dateline & counter to output in the template
        $attachpatchinfo['attachmentids'][] = $attachment['attachmentid'];
        $attachpatchinfo['dateline'] = $attachment['dateline']; // dateline & counter will end up being that of the 
        $attachpatchinfo['counter'] = $attachment['counter'];   // last attachment, but that should suffice.
    }
    else
    {
        // do default vb moderated attachments (but save 'em to our variable)
        eval('$attachpatchinfo[\'moderatedattachments\'] .= "' . fetch_template('postbit_attachmentmoderated') . '";');
        $attachpatchinfo['showmoderatedattachments'] = true;
    }

    // set to false so that the vB original loop does less
    // it does a moderated attachment instead of the real ones.
    // which will have to be erased later.
    $attachment['visible'] = false;

    // last time thru the loop, save the info for later.
    if ($attachpatchinfo['mycounter'] == $attachcount)
    {
        // format the filesize nicely
        $attachpatchinfo['combinedfilesizepretty'] = vb_number_format($attachpatchinfo['combinedfilesize'], 1, true);

        // save the whole she-bang for the next plugin.
        $this->post['attachpatchinfo'] = $attachpatchinfo;

        // we know there's at least on visible (not moderated) attachment
        if ($attachpatchinfo['visibleattachments'])
        {
            $attachpatchinfo['attachmentids'] = implode(',', $attachpatchinfo['attachmentids']);
            
            global $threadinfo;
            $attachpatchinfo['encodedthreadtitle'] = urlencode(base64_encode($threadinfo['title']));
            
            // process all attachments thru the postbit_attachmentszippedtogether template
            // do it here at the end, so it only gets done once.
            eval('$this->post[\'otherattachments\'] .= "' . fetch_template('postbit_attachmentszippedtogether') . '";');
            $show['otherattachment'] = true;
        }
    }
}