I've been hacked?

[Buzzle]

Originally Posted by Dave

Alright, that looks fine.
Now:

- Be sure the /install folder is not present on your vBulletin installation.
- Check all of your active plugins, there shouldn't be any fishy plugins with odd names.
- In your ACP go to Maintenance > Diagnostics > Suspect File Versions. Check if there are any weird files which were created recently on your server.
- Change the password of all administrator/moderator accounts.
- Protect your ACP with a plugin like this: https://vborg.vbsupport.ru/showthread.php?t=296383

Edit: vBulletin version is very outdated, update to the latest.

I've ran the scan and the only thing that it couldn't recognize were the plugins I added. I want to back my forums up but couldn't it just happen again?

Also, i've searched the plugin manager. Everything seems to be normal.

[ozzy47]

As I said in post #2, you need to follow the links.

Please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked
http://www.vbulletin.com/forum/blogs...vbulletin-site
Also please see these recent security announcements:
vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions

Make sure you do not skip over any steps.

[Buzzle]

Originally Posted by ozzy47

As I said in post #2, you need to follow the links.

Please read the following two blog posts:
http://www.vbulletin.com/forum/blogs...ve-been-hacked
http://www.vbulletin.com/forum/blogs...vbulletin-site
Also please see these recent security announcements:
vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions

Make sure you do not skip over any steps.

So if I ditch inferno, back it up from a safer time, add ACP protection there would be no way he could access it again?

[Dave]

Without having access to your ACP and access logs, we don't know how the person accessed your ACP.

[ozzy47]

There might, that is why you need to follow all the instructions in the blog posts, as well as ditch inferno.

[ozzy47]

Originally Posted by Dave

Without having access to your ACP and access logs, we don't know how the person accessed your ACP.

And if they are smart, they deleted this info.

[Buzzle]

Originally Posted by Dave

Without having access to your ACP and access logs, we don't know how the person accessed your ACP.

Is there a chance you can come on my teamviewer and have a look?

[TheLastSuperman]

Ahh one of the multiple admin, do import hackers - look for one or more shell scripts uploaded to your server. Sometimes in clientscript/ or /includes and be sure to check any sub-folders.

Are you running any nulled modifications? Inferno Shoutbox Revolutionized what's that?

I'd submit a ticket and ask your hosting company to scan w/ whatever they have setup on their server be it Maldet (also referred to as Linux Malware Detect (LMD)) or similar but before warned some of these shell scripts are custom per site (depends on if you were worth their time) so Maldet and others do not always pick those up and the ONLY way to be sure is to go through all your folders by hand.

*Some stuff will stick out like a sore thumb, same way they want to be pompous and instead if using legit names like Admin for the 5-6 spare accounts its always something cocky such as lolwut, lmao, amongst other names I've since long forgotten the point being most of its easily spotted (file names such as shell.php / sexy.php / lol.php and similar) but every so often they hide one or mores files very well w/ names that seem valid so be sure to use the Maintenance tools in admincp and do suspect files and other tips in the links Ozzy posted above.

[ozzy47]

TBH it don't matter now how they got in, you need to plug the holes. First off by following all the instructions in the blog posts, then upgrade to at least 4.2.2

[Buzzle]

Alright, i'm going to back it up to yesterday and remove inferno shoutbox. Anything else?