My forums have been hacked! How to fix?

[ProjectDIBS]

Hey all,

My forums have been hacked!+

http://www.reefstewardshipfoundation.org/forums/

I am still able to access my CP and I'm running version 3.8.3

I don't know the first thing about fixing a hack attempt, how do I get rid of this?

ANY other day of the year and it wouldn't have been a huge problem, but I'm supposed to have some professors looking at my forums for how I am building a community.

HELP!

Brian

[Lynne]

Hard to tell what they did. Usually you can reupload all the vbulletin files and make sure to remove any files they added to your server. Sometimes, if they altered the database, you would need to import a backup database.

You should be talking to your host about this to find out how they got access to your site to change things.

[ProjectDIBS]

Originally Posted by Lynne

Hard to tell what they did. Usually you can reupload all the vbulletin files and make sure to remove any files they added to your server. Sometimes, if they altered the database, you would need to import a backup database.

You should be talking to your host about this to find out how they got access to your site to change things.

I just got off chat with my host and they said this is a vbulletin software issue, not their problem.

How do I tell what files they have uploaded? I checked the forums directory and no files in the directory have been modified since 7/13/09.

Would it help if I went to vbulletin.com and contacted someone there? Isn't there some time of license support? I'm out of my league here.

Brian

[Lynne]

You could put in a support ticket and they would help you. However, you have done nothing in regards to figuring out how they did this. You need to look at your access_logs (if you don't know where they are, ask your host) and see how they did this. If you don't figure out how they did this, and fix the issue, they will just do it again.

[Angel-Wings]

Originally Posted by ProjectDIBS

How do I tell what files they have uploaded? I checked the forums directory and no files in the directory have been modified since 7/13/09.

In a worst case - all. The date says nothing since it's a simple command to modify the file date.
To really ensure there's nothing left uploading all files again is maybe the best way.