Vbulletin support ?

[techy111]

Guys i just checked a latest member user on my site and he's called "supp333" and he's been saved as an Administrator ??????

I'm the Administrator on MY site and i didn't make anybody else Admin !

Has anybody heard of this ? His email is vbulletin support

Is this genuine or a Hacker ?

Please advise....Urgently.

[ForceHSS]

Hacker, vb support would not do that

[techy111]

What am i doing wrong to allow them in ? I have just spent days re starting and re-installing my site as previously my whole database was hacked and i lost everything !!!

--------------- Added [DATE]1381788333[/DATE] at [TIME]1381788333[/TIME] ---------------

And now after trying to ban him i get this.....

"You are not authorized to ban users who are not considered normal, registered users"

[ozzy47]

Did you follow all the items in the following links thoroughly?

http://www.vbulletin.com/forum/blogs...ve-been-hacked

http://www.vbulletin.com/forum/blogs...vbulletin-site

[techy111]

I was in the process mate , but been on nights for the last 4......any ideas how to ban this user quick ?

[ForceHSS]

looks like they added there user id to the config check and remove them fast then delete them then do what ozzy said above

[ozzy47]

Most likely coming from a plugin, or could be a cron, disable all your mods while doing the above steps.

Open your config.php and below<?php add this line:

PHP Code:

 define('DISABLE_HOOKS', true); 


So it looks like this:

PHP Code:

<?php
define('DISABLE_HOOKS', true);
/*=================================================  =====================*\
|| ##################################################  ################## ||
|| # vBulletin 4.2.2

[techy111]

Config.php has gone missing

[ForceHSS]

if site still running then it should be there it is in the includes folder

[techy111]

Found it....name has been changed to configminehaha.php