Got hacked. What now?

[Berethorn]

Yes, Lynne, this is a wakeup call indeed. I may reinstall and tighten things up after I get the problem sorted out. The main thing now to salvage months of user data, posts, and settings.

I did as Quarterbore said, and confirmed it to be a database problem.

Snakes1100, there are hundreds of pages in the phrases table in the database (if that's what you meant). Any hint where to start?

[Quarterbore]

So, how did you fix it?

http://www.landofrohan.com/forum/forumdisplay.php

edit - never mind you did a fresh install huh?

[Berethorn]

It's not fixed... I just did like you said and installed vb to a new database then edited the original config.php to point to it. The old database is still there, and I'm looking through it. Perhaps I could try exporting and importing bits from the old database into the new "test" DB until something breaks.

[Quarterbore]

I would go with snakes suggestion first.

Try searching for "index4_files" in your database...

If that doesn't work, look for something else in the source code that would be unique like "hacked" perhaps.

[snakes1100]

Sorry, you will need to search the entire DB, in phpmyadmin, click the db to view all the tables, click search form there at the top and click/select all tables to search at one time. with keywords/phrases that the hacker has on the page.

[Berethorn]

I haven't found anything that way... my feeling is that the "hacker page" is remotely hosted, and that none of what you see is actually in the database. What I fear IS in the database is some harder-to-find redirector.

[puertoblack2003]

Originally Posted by snakes1100

Sorry, you will need to search the entire DB, in phpmyadmin, click the db to view all the tables, click search form there at the top and click/select all tables to search at one time. with keywords/phrases that the hacker has on the page.

quick question, why would it be in phrase? wouldn't that be either in post or thread in db ?.Back when we had the forum that was being hacked by scripts kiddys because of a old mod here.And i was able to resolve it tru those two tables.

[Quarterbore]

...try looking for "REFRESH" or "HTTP-EQUIV"

I know you don't know me but if you would like help I would be glad to try to help but the only I could do that is to get access to your database. I am very curious how they did this for the tool I am coding hence my interest.

EDIT: you are searching like this, right:

%refresh%
%http-equiv%
%index4_files%

I ask as I get hits for the first two and my site is not hacked. But there are not may of them so you can look at them to find the cause.

Also search for this if you are not finding anything...

%base64%

[Berethorn]

I FOUND IT!

It was your base64 hint! There was base 64 code hidden in the templates table, in a row with the title "spacer_open" which was part of something I added long ago - I don't know what for. But I think it was a random placement of the base64 code. I copied and then deleted the offending code, and now the site seems to be back to normal! Absolutely stunning what some code in one obscure area can do...

So thank you so much everyone! and especially Quarterbore who came up with the key to the mystery in the end: is there any information you want from me to help with your tool?

[snakes1100]

Originally Posted by puertoblack2003

quick question, why would it be in phrase? wouldn't that be either in post or thread in db ?.Back when we had the forum that was being hacked by scripts kiddys because of a old mod here.And i was able to resolve it tru those two tables.

I never said it was "in" a phrase, i said search for a "phrase" that the hacker used, ie keywords.

--------------- Added [DATE]1224203268[/DATE] at [TIME]1224203268[/TIME] ---------------

Originally Posted by Berethorn

I FOUND IT!

It was your base64 hint! There was base 64 code hidden in the templates table, in a row with the title "spacer_open" which was part of something I added long ago - I don't know what for. But I think it was a random placement of the base64 code. I copied and then deleted the offending code, and now the site seems to be back to normal! Absolutely stunning what some code in one obscure area can do...

So thank you so much everyone! and especially Quarterbore who came up with the key to the mystery in the end: is there any information you want from me to help with your tool?

Keep your forum closed and update the forums, hacks, remove any files from the server that are no longer used, the security hole is most likely still there.