is my forum hacked or not? please help.

[andry99]

Hi all,

I just visited my forum http://www.clubcav.com/index.php and i saw some posts has a strange title "www.gmscf.com".

also when i logged in as admin, i couldn't see forum boards. i see only Mark Forums Read View Forum Leaders

Other thread that members created also has strange title. it change to be "www.gmscf.com".

What 's happen with my forum? how to fix that?

Thank you for help.

[aussiefooty]

Do you allow guests to post on your forum?
If you do go into your admin cp > usergroup manager > unregistered and not logged in > can post in forum > no
Sounds like you might have a spammer.

[aussiefooty]

Hi all,

I just visited my forum http://www.clubcav.com/index.php and i saw some posts has a strange title "www.gmscf.com".

also when i logged in as admin, i couldn't see forum boards. i see only Mark Forums Read View Forum Leaders

Other thread that members created also has strange title. it change to be "www.gmscf.com".

What 's happen with my forum? how to fix that?

Thank you for help.

You have got a spammer on your forum. I have just had a look at it. What you can do here is click on the thread > delete as spam > Ban person > yes > save
Then go into your admin cp again > human verification manager > Question answer> Make up your own question and answer > Save

[andry99]

Hi thanks for responses.

But how can they can change members signature and update title from member's posts? also put their adsense on my forums.

any help, please?

[SecondV]

Hi thanks for responses.

But how can they can change members signature and update title from member's posts? also put their adsense on my forums.

any help, please?

If that's the case then yes, you may have been hacked. Looks like you are using vBulletin 3.8.1 which if I'm not mistaken, versions prior to vB 3.8.4 PL1 do have some security issues.

1. I'd highly recommend you upgrade to vB 3.8.4 PL 1 if possible.
2. Make sure your admin password is secure (CHANGE IT!) and do the same for anyone else who may have access to the Admin or Mod CP.
3. Do cleanup of any threads this person may have posted/changed.
4. Change the name of your admin and mod cp directories if you haven't already and update ./includes/config.php
5. As an extra layer of security, consider protecting the admin cp and mod cp directories with htpasswd.
6. Take a look at http://www.vbulletin.com/forum/showt...ms-More-Secure
7. Go to your ACP > Maintenance > Diagnostics > Suspect File Versions and see if any core vBulletin files have been changed or if anything seems out of place (files you may not have added yourself, or any plugins/mods may have added)