We've been hacked and I don't know the first thing about it

[terracore]

at this URL I found a list of reported sites defaced by this "hacker":

http://www.zone-h.org/component/opti...acer,ALQAISER/

[terracore]

Thanks for all the help. I did all the things mentioned and got hacked again! I noticed 3.7.4 came out so I upgraded to that. The only other thing I can think of was vb ad management? So I disabled that one too.

I checked the chmod of my files and directories.... they all look good. My impex files were still there from the original setup so I deleted those. password protected the admincp and modcp directories, etc.

Still not sure what else to do to keep them at bay.

[Digital Jedi]

Have you contacted your host to make sure it isn't a server side vulnerability that's being exploited?

[terracore]

Originally Posted by Digital Jedi

Have you contacted your host to make sure it isn't a server side vulnerability that's being exploited?

Yes. Of course they say that their hosting is absolutely perfect and the problem MUST be with vbulletin.

[veenuisthebest]

Follow all the steps mentioned in this guide. Do put .htaccess with "deny from all" in includes and install folder.

https://vborg.vbsupport.ru/showthread.php?t=193930

If problem still persists, then 100% the hack attempt is from server side.

[terracore]

Thanks- I had never been told to protect the includes folder before.