My forum Hacked by formatxformat need help!

[Jump]

I have a major problem!!! When I go to my forum site I get redirected to a foreign forum!! And says that it has been hijacked!!!What do I do??? I feel so desperate for my users and people trying to go there? How do I get my forum back? I can even get to my forum to sign in.......please help....confused and upset :-(

[JamesC70]

Only your forum home (index.php) is being redirected. The forums themselves are still there: http://www.skydive-info.com/skydivin...thread.php?t=1 still comes up as a valid thread.

Contact your webhost and ask them to remove the forwarding of http://www.skydive-info.com/skydiving/index.php .

[Jump]

Only a redirect?

How did this happen? Are you sure it's just a hosting problem?

[gg2-hungama]

Dude what are you still doing the guy just redirected yet...before they completely whipe your piece out call your godaddy shyt hosting and get your things cleared... if u dont have number call them they are 24x7

[zlos]

Probably you installed some plugins or addons from vbulletin.org, which are vulnerable to such attacks. I know these Kurd guys, as they wiped out my servers some years ago thank to some old plugins, which allowed them to write to my servers.

Solution:
- check index.php & config.php files
- remove (physically) all plugins, especially those with ability to write pictures to your forums (as well as ibproarcage game-like plugins).

The Kurds are working so, that somewhere they left backdoor on your system. So, hire somebody who will find and deactivate this backdoor, because they will surely attack you again through the backdoor.

For the future, don't install everything from vb.org what you this is nice. Consider most of those plugins as possible security problem.

Take care

[Jump]

What do I look in the index and Config?? this does not help...I need help...someone..anyone...

[Jump]

plug ins i have....isbot, signature limit - kpt, unread posts.

[zlos]

As I told you, find somebody, who will search your site and remove backdoor. If the Kurds are able to write to your disks, they have already saved a backdoor program to your disks.
There is no better advise for now. You need to give your user/pass to somebody who know what to look for.

[Jump]

thanks for you help!...I will talk with hosting and hope to recover my forum. To much work and hours to see this happen:-(

[zlos]

They added one extra line on the top of index.php file, redirecting browser to their forums. It's the beginning... With me was the same, after a week of playing in such "extra lines" one f.cker simply removed my document root. Without backups that would be the end of my business...

[Jump]

index & config

I have uploaded original and overwritten existing index.php and config.php......and did nothing, still getting the redirection.

I think you are incorrect that the index or config file was hacked....if they were...wouldn't the new file uploads fix it?

Hosting company is working on finding out what happen.....waiting impatiently...:-(

Any other advice, suggestion, or comments from anybody?

[Jump]

index hacked?

My hosting company is working on this.

Doe anyone know if any of the Mods I listed above are a security problem?

[Jump]

Tepmlate modification

Hi there,

I need help finding table template ID 737 (forumhome). When I go to the forumhome template the Id is 1169. Trying to find the malicious code that was placed by a hacking bot from japan.

Any idea where to find 737?

[Jump]

The fix-it mod fixed the bad template. Excellent mod...and saved me a lot of hassle and headache.

I highly recommenced this to any body whose forum is injected with a malicious code.

[Elyk]

What fix-it mod?