Random account set to Administrator?

[ozzy47]

Follow the links in post #6

[tbworld]

Originally Posted by ThatGreenAlien

Today I woke up to see the newest member, some random account named qaz001 was in the administrator group? We banned them before anything was done, but what is this and what can we do to stop it? Is this like a hack or something?

I did a google search on the name, and a lot of other random boards have the same account set as an administrator... what's up with this?

Prior to being hacked was your install directory already removed. I am curious?

--------------- Added [DATE]1381361252[/DATE] at [TIME]1381361252[/TIME] ---------------

Originally Posted by Grimes

I have the same exact thing happening.

Prior to being hacked was your install directory already removed. I am curious?

[ozzy47]

Even if it was, the site could have been compromised before hand, and the script was not executed before today.

[Grimes]

No! Son of a...it wasn't deleted. That's likely the cause then. Removed it. Thank you.

[tbworld]

Originally Posted by ozzy47

Even if it was, the site could have been compromised before hand, and the script was not executed before today.

I did realize that, but there was no question I could ask that would insure the desired response. So I am just data collecting.

[ozzy47]

Well ain't that a kick in the bullocks, Now I would definitely follow the links in post #6.

[afonseca]

Thanks for sharing, I noticed the same plugins "ech" installed with the following code:

PHP Code:

if(isset($_GET["ech"])) {
echo("0101");
exit;
} 


I've just deleted them.

[DoubleGlasses]

I am dealing with exactly this -

SO 2 weeks ago - I came to my site and found this


Imagine my horror lol!

I tried to lock everything down , removed the bad code and all was quiet. Then 2 weeks later - I get a malicious code warning from my google chrome. I check my admins and Voila! There are like 10 new admins added to my site! So again I locked everything down. Then this morning I wake up to see 10 new registrations - and guess what - they are exactly like what's posted above. So I realize that I never really deleted my install folder.. in fact i just removed the install file to deactivate it. So I'm off to follow the instructions on the links and to try again. I think I"ll be doing a fresh install of VB anyway and deleting all of my plugins till I get to the bottom of this.

Also - I looked in that ech plugin ( and I have 6 of them...) - and this is what I see :

[tbworld]

Make sure you read through this thread and especially the post from @ozzy47 and follow the current guidelines -- if you have not already. Sorry you were hacked.

[DoubleGlasses]

Thanks - I'm actually going down that list meticulously and working on locking the site down AGAIN!I'm soo appreciative of you guys and sharing this info...