Site hacked, can someone please help?

[HMBeaty]

Just another piece of advice, you may want to .htaccess your admincp and modcp (and also rename to something more secure if you wish)

[jaycob]

There's no vbf.php file in my includes folder, weird.. But it is f*cked up, they said they haven't touched any files but it seems they did. + They f*cked up the database.

if the hackers have messed up the database, is CYB rules still to blame for this? or vbulletin.

and yes to above up a few posts, when i add a new user its like user ID 123244533.

http://www.vbadvanced.com/

ahhh thanks.

[jaycob]

I board got hacked too now is running fine

Instruction how to remove

1) Search for new update file and delete it
go to your root forum

and run this command to fine new update file
login as shell

find . -mtime -1 -print

(-1 is day of update file)

you might see this file and delete it

index.php
index.html
admincp/index.php
admincp/index.html
modcp/index.php
modcp/index.html

and delete unknow files

and Upload load original files you just delete it


2)reset admin login to admin cp

upload tools.php to admincp
and reset admin login

3)login to admincp and disable Cyb rules and install new version do not foget to over write it

4)Go to phpmyadmin
go to Table: user

4.1delete everything in this field = usertitle
UPDATE user SET usertitle = ''

4.2update this field customtitle =0
UPDATE user SET customtitle = '0' where customtitle = '1'

4.3. deelte user id that over '13371337'

4.4 Table: user > AUTO_INCREMENT set number to you real latest user

5)Go to admincp > user group > adminstrators
Delete user that you didn't add

6) admincp > update counter > update user title
this step you will get users title back

7) turn on board

---all done ---

im still getting after adding new user the id (id: 13371339)
user befor that is fine ie: 57000.

[Herzog]

searching more log files, we've narrowed down the hit on ours. Obviously a script followed by a person to check the status.

Run a search through your logs for a GET request of: /?page=
and a POST request of: /?page=[randompagetitle]/register.php?do=register

[randompagetitle] is random, including what they used in our logs would be irrelevent.

[vktechnology]

Hi jaycob
Set Table: user > AUTO_INCREMENT to this number 57001

[jaycob]

searching more log files, we've narrowed down the hit on ours. Obviously a script followed by a person to check the status.

Run a search through your logs for a GET request of: /?page=
and a POST request of: /?page=[randompagetitle]/register.php?do=register

[randompagetitle] is random, including what they used in our logs would be irrelevent.

thanks.
would re-uploading all vbulletin files help? thx

[jaycob]

Hi jaycob
Set Table: user > AUTO_INCREMENT to this number 57001

in phpmyadmin? i cant find that option AUTO_INCREMENT when edit the last user? thanks mate.

[SilentSleeper]

in phpmyadmin? i cant find that option AUTO_INCREMENT when edit the last user? thanks mate.

Click on your user >table then click on your >Operations link located at the top and then change it in your >Table options

[jaycob]

Click on your user >table then click on your >Operations link located at the top and then change it in your >Table options

thanks worked link a charm. thank you.

my main forum is lagging, im hoping its just the server.

[Cristi_XP]

how do I run the ???
4.4 Table: user > AUTO_INCREMENT set number to you real latest user
Last user has id 36260
Because i am getting some errors when running the SQL command .
thanks

[Peter_AUS]

Find the user, edit their number to be what you want it to be. Then run fix usernames in the admincp, that worked for me.

[AusPhotography]

I decoded the vba.php file - CyberAnarchy.org maybe part of this hack

[tlwwolfseye]

Do I now have to be afraid of running any other Mods of him (either for v3.x or v4.x) because of this ? My trust in his Mods just went out of the window.

[AusPhotography]

You should also change DB, root and other major passwords. Just good practice

[tlwwolfseye]

No practice that wasn't really necessary. Just getting a negative wibe about others of his (Valter) Mods.

And yes, I changed all these Passwords and other things. And tbh, people that do something like this (the hacker I mean), should be shot on sight. Sorry for the harsh words, but there is nothing to forgive in my oppinion about killing someone else's work.