Have I been hacked?

[civileng68]

Can someone tell me what is going on here?

www.dizpix.com

Basically one day it worked and then one day it didn't and going to the page would ask to download a file called "forum". Is this a hacker trying to load a virus in?

Basically are my forums ruined? Can someone tell me something to do?

Thanks.

[Jose Amaral Rego]

Do you access to admin area or is this just front page you are having the problem.

[civileng68]

I normally access my Admin through the front page and I can't even get there. Unless there's a back end way to access it, No I can't.

Obviously through my host, I can go in and edit files if need be. Yes, I can do that, but no, I can't enter the admin panel through the front page of my VBulletin site.

[Jake Bunce]

A prompt to download a PHP file can mean that PHP isn't installed or is not working properly. You should contact your host about this. We can take a closer look if you submit a trouble ticket with a URL and admin login to your forum and a FTP login to your server:

http://members.vbulletin.com/members...ontactform.php

[Lynne]

Whatever it is, did you notice the file says it is coming from disneymouseradio, not disneyworldpics?

[Jose Amaral Rego]

Whatever it is, did you notice the file says it is coming from disneymouseradio, not disneyworldpics?

http://72.14.253.104/search?q=cache:...1&client=opera

[civileng68]

Whatever it is, did you notice the file says it is coming from disneymouseradio, not disneyworldpics?

Yes, that's the name of my url through my host since the forums are using the same host as my main site which is completely different.

So, it doesn't look like I'm hacked?

I guess I can contact my host and if nothing comes of it, I'll do a ticket. I know I didnt do anything because it was working PERFECTLY and I did nothing in between.

Also, I did the files exactly as said in the instructions and made sure to delete or move as directed. However, I'll check.

If I check with my host, what am I asking them?

[steven s]

Can someone tell me what is going on here?

www.dizpix.com

Basically one day it worked and then one day it didn't and going to the page would ask to download a file called "forum". Is this a hacker trying to load a virus in?

Basically are my forums ruined? Can someone tell me something to do?

Thanks.

Do you have some sort of audio file that plays?
The file downloaded is tuba33u5.
Look at
http://readlist.com/lists/lists.mozi.../13/66212.html

[civileng68]

Do you have some sort of audio file that plays?
The file downloaded is tuba33u5.
Look at
http://readlist.com/lists/lists.mozi.../13/66212.html

No. No audio. I have LINKS to video files but NOTHING is played directly on the forums. Also, I've never named a file tuba33u5.

Does that mean it was a hack or could it just be an error? I saw the link but didn't really understand.

[steven s]

Every time I go to your site another file is downloaded to my HD.

[MediaHound]

FTP in and check the modified date on your index.php file.

Re-upload a new index.php.

Check for obfuscated code in the index.php file at the bottom of the page.

Set password expiry for each usergroup to "1" and put members on notice to change password on all sites that share the same password.

[civileng68]

FTP in and check the modified date on your index.php file.

Re-upload a new index.php.

Check for obfuscated code in the index.php file at the bottom of the page.

Set password expiry for each usergroup to "1" and put members on notice to change password on all sites that share the same password.

Okay,. thanks so much.

I may sound like an idiot but, how do I redownload a new index file? Do i use the one I already downloaded or a new one from the site (vbulletin).

Also, what is obfuscated code?

Lastly, how do I get into the password expiry (I can't get into my admin panel), unless you are saying the other things should fix it to then allow me back in?

Sorry to sound so naive, but I am. Thanks so much for the help here. I may have just Vbulletin make the fixes.

[MediaHound]

I did not visit your site, I do not know if that advice applies to you.

Looking closer at your problem it does not match what I initially thought was the case.

You can use the one you purchased and downloaded initially, perhaps if you were hacked just the one on the server will be bad.

obfuscated == changed so its not easily read by human eyes

Not sure if one fix will lead to another for you, but perhaps what I noticed on one site having a similar problem at the moment is different than what you are experiencing.

[steven s]

Your index page is

<html>
<head>
    <title>disneyworldpics.com</title>
    <meta name="keywords" content="mickey, mouse, walt, disney, world, minnie, pluto, goofey, goofy, photos, photo, camera, photography, film, digital, share, upload, pics, disneyworld, disneyland, land, walt, waltdisney">
</head>
<frameset rows="100%" scrolling="yes" border="0">
    <frame src="http://www.disneymouseradio.com/forums">
        <frame src="http://webhosting.yahoo.com/forward.html" marginwidth="0" marginheight="0" scrolling="no" frameborder="0">
        </frameset>
        </html>

The problem lies with http://www.disneymouseradio.com/forums

EDIT: Although, there is also a problem with http://webhosting.yahoo.com/forward.html

[civileng68]

Your index page is

<html>
<head>
    <title>disneyworldpics.com</title>
    <meta name="keywords" content="mickey, mouse, walt, disney, world, minnie, pluto, goofey, goofy, photos, photo, camera, photography, film, digital, share, upload, pics, disneyworld, disneyland, land, walt, waltdisney">
</head>
<frameset rows="100%" scrolling="yes" border="0">
    <frame src="http://www.disneymouseradio.com/forums">
        <frame src="http://webhosting.yahoo.com/forward.html" marginwidth="0" marginheight="0" scrolling="no" frameborder="0">
        </frameset>
        </html>

The problem lies with http://www.disneymouseradio.com/forums

Are you seeing a problem there? If so, where is it?

Is this something that I can pay to have Vbulletin fix? I have over 800 members and Im sure they're curious as to what is going on.