4.2.1 PL1 hacked, what to look for in logs

[ozzy47]

And I assume the same thing for each usergroup?

[ifitsmedia]

Yes, HTML is disabled in all usergroups as well.

[ozzy47]

And you have went through all the php files in your forum root, and there is nothing there that should not be?

[ForceHSS]

Have you changed all passwords for all admins, FTP and capnel if not it needs done. The next step is to hire someone to find out how you have been hacked

[ozzy47]

How about any erroneous cron jobs? ACP --> Scheduled Tasks --> Scheduled Task Manager

[ifitsmedia]

I ran Maintenance > Diagnostics > Suspect file versions and checked every file that had a notice. Aside from some older files from previous versions of VB and old plugins, nothing was out of place.

I replaced all VB core files with fresh downloads, and replaced most plugin files as well.

Sucuri and ClamAV didn't find anything either.

--------------- Added [DATE]1407701446[/DATE] at [TIME]1407701446[/TIME] ---------------

Originally Posted by ozzy47

How about any erroneous cron jobs? ACP --> Scheduled Tasks --> Scheduled Task Manager

Those all seem to be ok as far as I can tell. There's a couple from mods and the rest look like core VB tasks.

[tpearl5]

Originally Posted by ifitsmedia

Thanks tpearl5. Yes, install dir was already removed.

I also suspect there is a backdoor somewhere, or a file that is vulnerable to sql injection. I'm wondering if there are some strings I can search my apache raw access logs for to identify the culprit.

I'm not sure anything would appear in the access logs, but you may want to look at and sort by the modified dates of any files (not just vbulletin ones).

[doctorsexy]

Why are you on 4.2.1 and not 4.2.2

[ifitsmedia]

It was due to incompatibility with a mod I was using. I'm no longer using it and will be upgrading, but I don't think 4.2.1 PL1 -> 4.2.2 PL1 fixes any security issues.

[ozzy47]

Looks like you may have to resort to paying to have it sorted.