I Believe I was Hacked - Please Help

[myagentcam]

Hi all. I woke up the other day and my site suddenly redirected to a spam site. I found a redirect rule in the htaccess that was added, so I removed it, and then my site worked for a few minutes. It then gave me an error of:

======
Error :syntax error, unexpected ')' on line 227 in /home/camina2/public_html/jazzhoops.com/forum/includes/vb5/frontend/controller/bbcode.php
Step 0: showErrorPage() called on line 289 in /home/camina2/public_html/jazzhoops.com/forum/includes/vb5/applicationabstract.php
Step 1: handleException() called
Exception syntax error, unexpected ')' on line 227 in /home/camina2/public_html/jazzhoops.com/forum/includes/vb5/frontend/controller/bbcode.php

Anyone have any idea on how to easily fix this? I'm somewhat of a beginner with this all, so the more detailed response the better. I would love that. Thank you.

[mna]

There was a big vbulletin hack last week. Like other said do a fresh clean install OR easier option is live chatting my host (namecheap) for them to do a full cpanel reset to a backup they have, that way you don't have to search your database for stuff the virus might have changed. I have namecheap and they had a cpanel backup on around September 21th that I chose for them to reset it to (which resets the hosting and database). My site was hacked around September 25th so the 21st should be fine....if you want to be safer and don't have much new content on your site you could even do a earlier backup like September 6th. Just make sure to turn your site off immediately after they restore it, and patch it ASAP to the new version.

Here are some quick update instructions I made:
1. Turn off your forums.
2. Create a database backup via putty/ssh with this command: mysqldump --opt -Q -u databaseUser -p databaseName > backup1.sql
this command sends backup database to the root directory of your hosting account with the filename backup1.sql. the password. replace databaseUser/databaseName with your details.
3. Upload the contents of UPLOAD folder except favicon.ico (also check .htaccess) with FTP client.
4. Run /core/install/upgrade.php in your browser.
5. Delete the /core/install folder
6. Turn on your forums.

[myagentcam]

Thanks for the info. What do you mean by the comment (also check htaccess?)

[mna]

I meant to just be sure you don't overwrite your old one if you made special rules in it and want to keep it.

[myagentcam]

Ok. That makes sense. I think I'm all set with the htaccess file.

I just uploaded all new files and ran the upgrade script. Everything seemed to go fine and i can connect to the admin CP page. When I log in I get this error on the page.
This page isn’t working

jazzhoops.com is currently unable to handle this request.

HTTP ERROR 500

Any ideas?

When I go directly to jazzhoops.com, it loads and everything looks good, but the forum cannot be used because I have it disabled in the admin CP.

[Wayne Luke]

Please open a support ticket providing AdminCP and SFTP information.

[myagentcam]

Hi Wayne. I'm sorry, but I don't understand what you are asking for.

[Wayne Luke]

I am asking you to open a support ticket so we can get your site up and running. You seem to be struggling with doing this.