Site hacked, can someone please help?

[jaycob]

How does one do this? After this is fixed I am moving to bbpress, tired of vbulletin and it's constant ****.

its not vbulletin software, its the 3rd party addons, which basically its install at own risk.

[forex4noobs]

I think all mentions of %animus% needs to be removed from the database.

How does one do this? After this is fixed I am moving to bbpress, tired of vbulletin and it's constant ****.

[cataclyzmic]

I think all mentions of %animus% needs to be removed from the database.

[moneymaker]

I found these if anyone cares to push forward with legal action.

[email protected]
[email protected]
master[email protected]
178.95.169.228
212.33.216.225
24.22.146.238

[forex4noobs]

Time for my questions

1. How do I fix user titles? They have all been changes to 'hacked by team animus'?
2. What exactly has been compromised here? Do I need to change all passwords?

[forex4noobs]

Can you please explain how you did that? I'm trying to disable to addon, but I cannot access AdminCP. It keeps redirecting it to the same page after I login.

1. Download the latest version of vbulletin.
2. In the zip go to the do_not_upload file and extract tools.php
3. Put tools.php it in your vb install folder via ftp.
4. Visit it in a browser.
5. You need to use the following options

[Reset Cookie Domain]
[Reset Cookie Path]

[Reset Admin Access]

6. Delete tools.php from the install directory.
7. Log in and disable all plugins quickly.

I do not know how to disable plugins first but I doubt the hackers are sitting on your server ready to hack again as soon as you fix it.

[cmfinc]

Can you please explain how you did that? I'm trying to disable to addon, but I cannot access AdminCP. It keeps redirecting it to the same page after I login.

id like to know as well. im trying to run day back up to see if it gets me back in but????

[Umbrae]

I have gained access to my forums again but I disabled all addons first via config then changed the main admin account using tools.

Can you please explain how you did that? I'm trying to disable to addon, but I cannot access AdminCP. It keeps redirecting it to the same page after I login.

[45Wheelgun]

Okay, guess I'll leave it disabled until this all blows over.

Does anyone know if disabling is "good enough"? I would prefer to disable, but want to make sure I don't need to uninstall.

I already updated to the "fixed" version, and then I disabled it. Should I remove it completely?

[Herzog]

We got hacked too. Adv Forum Rules installed. Pretty sure that's the problem... but we are grepping our log files to find out for sure. So far not much of a footprint.

[ctrlbrk]

Does anyone have IP addresses yet of where the attack is coming from?

[Alfa1]

I wonder if anyone got hacked that does not have 'advanced forum rules' installed?

[rjhollan]

Okay, guess I'll leave it disabled until this all blows over.

[Alfa1]

Does this effect the VSA Advanced Forum rules as well? We were running v5.0.1 (here) but weren't hacked...

Yes, CYB = VSA

[rjhollan]

Does this effect the VSA Advanced Forum rules as well? We were running v5.0.1 (here) but weren't hacked...