Forum hacked, keeps redirecting to to deface page after i deleted it

[TrevorS]

My vBulletin forum was "hacked" (actually one of my admins emails just wasnt secure >.>) They uploaded 2 shells and a deface page, which i deleted, yet it still tries to redirect to the deface page, and is in an endless loop of refreshing.

Basically when it was first hacked, when i went to mydomain.com it redirected to mydomain.com/deface.html

I then deleted deface.html, but it still tries to redirect to mydomain.com/deface.html

I DO NOT have a .htaccess file, I've looked and it is not there. I have tried to make my own, and it would not work, I even made sure to CHMOD it, but still no success.

does anyone know how to fix this?

[kh99]

Try running this script: https://vborg.vbsupport.ru/showthread.php?t=281080

Also, look in the Plugin Manager and see if there are any plugins you don't recognize.

[TrevorS]

I cant access my control panel because every page redirects.

[In Omnibus]

Have you tried disabling hooks globally via the config.php file?

define('DISABLE_HOOKS', true);

[kh99]

Yeah that. And while it doesn't hurt to run that other script, if your admincp is redirecting it's got to be something other than a template.

[Lynne]

Did you try using a database backup? If your database was also compromised, then that may be a good option.

[TrevorS]

Originally Posted by Lynne

Did you try using a database backup? If your database was also compromised, then that may be a good option.

database was not touched, only an admin account that wasnt even super admin. all they did was upload 2 shellls, a deface page, and whatever redirects every page.

[Lynne]

You cannot upload a file without ftp/server access, so what makes you think someone wasn't able to access the server and the database?

[betterthanyours]

Just throwing this out there, you should make sure the NameServers were not changed and that there are no forwarders

[TrevorS]

Originally Posted by Lynne

You cannot upload a file without ftp/server access, so what makes you think someone wasn't able to access the server and the database?

They uploaed a shell through the adminCP, then uploaded a deface page through that, i checked the 'last modified' date of all the files in my FTP, only the shell and the deface page were added.

Originally Posted by betterthanyours

Just throwing this out there, you should make sure the NameServers were not changed and that there are no forwarders

nameserves were not changed