vB hacked again. Need help

[ldempsey]

Thanks, Snakes.

I did post that I'm running version 4.0.2 PL1.

And no, I didn't do a full backup before running that command since it would have just backed up the malicious...

[ldempsey]

Hi guys.

I'm running version 4.0.2 PL1 and the site had gotten hacked.

This is very unexpected because I had changed the admincp directory and usercp names, password protected...

[ldempsey]

Mine says that too.

[ldempsey]

We've been having a similar problem too since the update to v 4.0.2 PL1

We're using user moderation. When a user registers, they can sign in, but if they try to make a post, they get a notice...

[ldempsey]

Hmmm... more questions indeed...

I've never heard of encrypting my pages. It would be helpful to encrypt my variables php files.

If someone could READ these php files directly,...

[ldempsey]

Just to be clear...

If you go to http://www.milw0rm.com/search.php and punch in "vBulletin"

You're stating above that all of these exploits listed there are either...

[ldempsey]

Thank you - there is some very good advice in there.
I hadn't thought of password protecting the admin and mod folders through htaccess. They are now. Of course, I did rename them right from the...

[ldempsey]

I found the site hacked again last night. I was able to remove the base64 entries from the database, but this time there were over 620 entries.

The owner of the site and I are keen to find...

[ldempsey]

Thank you, Wayne Luke.

This seams to have worked. Before doing a delete, I did a select and 2 entries came up with eval base64 decode.....

I should have known to look for...

[ldempsey]

Greetings,

(I did spend some time trying to search for existing threads on this issue)

Here's what's going on...

A hacker who goes by Mr.Sohayl (http://www.goog...