Site hacked, can someone please help?

[acwatts]

I have gained access to my forums again but I disabled all addons first via config then changed the main admin account using tools.

[gosborne]

I'm running Cyb Advanced rules too. taken site offline with 503, and sent support ticket to vb and host.

[krazeguy]

Just restored database and the site was taken down again. Wow, gotta be quick to disable that mod!!!

[cmfinc]

yes i was. im trying to get in and remove it see if it helps.

[ctrlbrk]

and i get to join the rest of you with this hack as well..

Are all of you guys that were hacked using "Cyb - Advanced Forum Rules" add-on?

[Alfa1]

It would be very helpful if everyone that has been hacked lists the vbulletin version and the addons that they are running.

[ikorolis]

from Cyb - Advanced Forum Rules
demo: http://www.bihforum.com/misc.php?do=cfrules

is HACKED by same team.

[cmfinc]

and i get to join the rest of you with this hack as well..

[krazeguy]

Do the hacked websites have vbSEO installed by any chance?

Mine did not, no. I was running latest version of VB4

[Alfa1]

vbSEO had a vulnerability but that was fixed with the latest release.

[krazeguy]

My sites totally locked out as well. Looks like restoring a recent backup is the only (easy) way out of this mess.

[acwatts]

Arrrrgg will someone just post instructions, what needs uploading or what needs changing in the database. ????????????????

[ikorolis]

agree but remember

the guys to using bugs or exploits hack the websites

modify .php files or .html or using sql db.

(sql db always using password (safe and strong) and always other for admincp or accounts)

not usefull db backup or rollback for this hack attacks.

[LauraM]

According to the last post in this thread: http://www.vbulletin.org/forum/showt...177559&page=21 , it isn't fixed. This guy says he just installed the latest version and got hacked.

Same here. I installed the latest version .........and a couple of hours later, it was hacked.

[Alfa1]

Zachery, please see the ticket that I have just opened. Theres two issues that may be related to this.