My forum admin CP changed by hacker

[hinomaru]

After disable all plugin the problem is gone, and the suspect is from the one of the plugin.

And after search with this query :

SELECT title, phpcode, hookname, product FROM plugin WHERE phpcode LIKE '%base64%' OR phpcode LIKE '%exec%' OR phpcode LIKE '%system%' OR phpcode like '%pass_thru%' OR phpcode like '%iframe%';

The code above from : http://www.vbulletin.com/forum/forum...37#post3506437

I got the result like this :



--------------- Added [DATE]1381973259[/DATE] at [TIME]1381973259[/TIME] ---------------

how to solve that?can I only delete the database record that shown above?

[Lynne]

Why can't you disable your plugins and then get into the admincp and delete the plugins via the Plugin Manager?

To temporarily disable the plugin system, edit includes/config.php and add this line right under <?php

PHP Code:

define('DISABLE_HOOKS', true); 


All three of those init_startup plugins need to go once you are able to get to the Plugin Manager.

[hinomaru]

Finally all fixed..thanks for the support