My vBulletin version 3.8.4 forum has been hacked - please help!

[Rialto99]

Hi everyone,

I'm hoping someone can help as I'm in urgent need of some assistance.

I'm running a forum on v 3.8.4 which appears to have been 'compromised'.

This is extremely bad as Google is now penalised my WHOLE DOMAIN in the organic serps.

With this in mind, can someone please take a look as what's going on here?

Background:

The forum was previously hosted at freelancesupermarket.com/forum but we've recently redirected this URL to our home page (freelancesupermarket.com) since we're currently in a transition period with the site and we wanted to take the forum down (so to speak) for a few months while we figure out what to do with it.

That being said, ALL other forum URLs ARE still live and working. We wanted to ensure that that they stayed live mainly for Google's purposes (and also for anyone that had saved any particular post URLs as a point of reference).

Here in lies the problem.

I'm not sure how the heck this has happened, and in all honestly i'm extremely disappointed that a vBulletin product has being compromised in this way, but when I attempt to load any forum 'post' or user 'profile' URLs, they're being redirected to a 3rd party website.

This doesn't happen every time I insert a URL - it appears to happen on a random basis.

As an example, take a look at this URL:

http://www.freelancesupermarket.com/.../malvolio.html

I've just typed it in and been redirected to this darn 3rd party website (i.e NOT the freelancesupermarket.com forum).

I'd be grateful if someone could take a look as a matter of urgency.

Thanks in advance
Martin

[Lynne]

I'm not getting any sort of redirect. Have you looked to see if you have some sort of virus/trojan on your server?

[Rialto99]

I'm not getting any sort of redirect. Have you looked to see if you have some sort of virus/trojan on your server?

Therein lies the problem. Because the redirect happens on a random basis, it's difficult to recreate the 'hack'.

There's certainly not a virus / trojan on the server - that I can say for sure.

Is there anything else you can suggest?

Thanks
Martin

[Steve Machol]

Works for me too. Have you tried removing your add-ons, such as vBSEO?

Also you should upgrade to 3.8.7 at the very least.

Please see this thread on how to make your vBulletin more secure:

http://www.vbulletin.com/go/secure

If you are still being hacked after doing all of this, then they are most likely doing this by accessing your server. You need to contact your host about this.

[DownForce]

It works for me too........you prolly have a virus/trojan on YOUR PC. Have you tried connecting to the site from a different PC? Are other people you know having the same issues?