Security and hacking gurus, need some help!

[ludachris]

Hey guys, I am in the process of cleaning up all the sites on one of our servers that was hacked due to a Remote File Include Vulnerability. Here are some links to what I'm talking about:

http://securitytracker.com/alerts/2006/Feb/1015624.html
http://www.soledadpenades.com/2006/0...-nothing-to-do

Basically what happened was, they somehow found a way to write to every file on our server. They added a few lines of IFRAME code that was meant to redirect our visitors to other sites. Every single file on the server was affected, although not all files had the same code added. Some had multiple lines of the same code, others had just one line. It's a dedicated server, and all sites on the server are ours.

The problem is I can't narrow down which script we're running would account for the security hole. Can anyone tell me which of these scripts it could be:

vbulletin - developers say it's not
vbadvanced cmps - developers say it's not
vbadvanced Links - developers say it's not
phpadsnew2 - http://phpadsnew.com/two/
ContactForm - http://www.free-php.net/scripts.php?id=2
Photopost Classifieds - http://www.photopost.com/class/
Photopost vbGallery - http://www.photopost.com/forum/forumdisplay.php?f=113
(formerly vbaGallery, not photopost pro)

And if none of the above, could it be a hack that has been added on to vb? We have a few. What should we be looking for? Any help would be appreciated. I'd hate to clean this all up only for somone to run a script and screw it all up again.

Please guys, I need to find out how to stop this from happening again. I've already cleaned up all files once and it took several days. It happened again today and we have to start all over.

[SCRIPT3R]

photopost is buggy as all hell and not even worth having on your forum IMO. horrible scripting, service, etc. i would look there before all else.

[ludachris]

Originally Posted by GearTripper

photopost is buggy as all hell and not even worth having on your forum IMO. horrible scripting, service, etc. i would look there before all else.

We're actually using vbgallery, which was not written by the guys at photopost, but the script is now owned by them. It was originally written by the guy who wrote vbadvanced CMS.

Anywhere else we should post this in order to get faster help? Any other information we need to post? Please guys, we really need some help here...