Site hacked, can someone please help?

[AusPhotography]

I decoded the vba.php file - CyberAnarchy.org maybe part of this hack

[Peter_AUS]

Find the user, edit their number to be what you want it to be. Then run fix usernames in the admincp, that worked for me.

[Cristi_XP]

how do I run the ???
4.4 Table: user > AUTO_INCREMENT set number to you real latest user
Last user has id 36260
Because i am getting some errors when running the SQL command .
thanks

[jaycob]

Click on your user >table then click on your >Operations link located at the top and then change it in your >Table options

thanks worked link a charm. thank you.

my main forum is lagging, im hoping its just the server.

[SilentSleeper]

in phpmyadmin? i cant find that option AUTO_INCREMENT when edit the last user? thanks mate.

Click on your user >table then click on your >Operations link located at the top and then change it in your >Table options

[jaycob]

Hi jaycob
Set Table: user > AUTO_INCREMENT to this number 57001

in phpmyadmin? i cant find that option AUTO_INCREMENT when edit the last user? thanks mate.

[jaycob]

searching more log files, we've narrowed down the hit on ours. Obviously a script followed by a person to check the status.

Run a search through your logs for a GET request of: /?page=
and a POST request of: /?page=[randompagetitle]/register.php?do=register

[randompagetitle] is random, including what they used in our logs would be irrelevent.

thanks.
would re-uploading all vbulletin files help? thx

[vktechnology]

Hi jaycob
Set Table: user > AUTO_INCREMENT to this number 57001

[Herzog]

searching more log files, we've narrowed down the hit on ours. Obviously a script followed by a person to check the status.

Run a search through your logs for a GET request of: /?page=
and a POST request of: /?page=[randompagetitle]/register.php?do=register

[randompagetitle] is random, including what they used in our logs would be irrelevent.

[jaycob]

I board got hacked too now is running fine

Instruction how to remove

1) Search for new update file and delete it
go to your root forum

and run this command to fine new update file
login as shell

find . -mtime -1 -print

(-1 is day of update file)

you might see this file and delete it

index.php
index.html
admincp/index.php
admincp/index.html
modcp/index.php
modcp/index.html

and delete unknow files

and Upload load original files you just delete it


2)reset admin login to admin cp

upload tools.php to admincp
and reset admin login

3)login to admincp and disable Cyb rules and install new version do not foget to over write it

4)Go to phpmyadmin
go to Table: user

4.1delete everything in this field = usertitle
UPDATE user SET usertitle = ''

4.2update this field customtitle =0
UPDATE user SET customtitle = '0' where customtitle = '1'

4.3. deelte user id that over '13371337'

4.4 Table: user > AUTO_INCREMENT set number to you real latest user

5)Go to admincp > user group > adminstrators
Delete user that you didn't add

6) admincp > update counter > update user title
this step you will get users title back

7) turn on board

---all done ---

im still getting after adding new user the id (id: 13371339)
user befor that is fine ie: 57000.

[jaycob]

There's no vbf.php file in my includes folder, weird.. But it is f*cked up, they said they haven't touched any files but it seems they did. + They f*cked up the database.

if the hackers have messed up the database, is CYB rules still to blame for this? or vbulletin.

and yes to above up a few posts, when i add a new user its like user ID 123244533.

http://www.vbadvanced.com/

ahhh thanks.

[HMBeaty]

Just another piece of advice, you may want to .htaccess your admincp and modcp (and also rename to something more secure if you wish)

[vktechnology]

I board got hacked too now is running fine

Instruction how to remove

1) Search for new update file and delete it
go to your root forum

and run this command to fine new update file
login as shell

find . -mtime -1 -print

(-1 is day of update file)

you might see this file and delete it

index.php
index.html
admincp/index.php
admincp/index.html
modcp/index.php
modcp/index.html

and delete unknow files

and Upload load original files you just delete it


2)reset admin login to admin cp

upload tools.php to admincp
and reset admin login

3)login to admincp and disable Cyb rules and install new version do not foget to over write it

4)Go to phpmyadmin
go to Table: user

4.1delete everything in this field = usertitle
UPDATE user SET usertitle = ''

4.2update this field customtitle =0
UPDATE user SET customtitle = '0' where customtitle = '1'

4.3. deelte user id that over '13371337'

4.4 Table: user > AUTO_INCREMENT set number to you real latest user

5)Go to admincp > user group > adminstrators
Delete user that you didn't add

6) admincp > update counter > update user title
this step you will get users title back

7) turn on board

---all done ---

[beishe8]

what hack is vba.php please.

http://www.vbadvanced.com/

[FallenBeauties]

There's no vbf.php file in my includes folder, weird.. But it is f*cked up, they said they haven't touched any files but it seems they did. + They f*cked up the database.