Register Members List Search Today's Posts Mark Forums Read

Reply
 
Thread Tools
  #1  
Old 01 Jan 2013, 06:04
airplane-dude airplane-dude is offline
 
Join Date: Oct 2005
Site Hacked - Added Unknown Plugin

Hi all,

My forums have been hacked.. I had an unknown plugin installed, and deleted.. and it's added re-directs and virus to my forums. Any ideas on how to 'clean' it? There are no unknown plugins on my forums now, but my admin log shows some bad activity:

ID User Name Date Script Action Info IP Address
40004 admin 15:18, 28th Dec 2012 plugin.php
40003 admin 15:18, 28th Dec 2012 plugin.php kill plugin id = 49
40002 admin 15:18, 28th Dec 2012 plugin.php delete plugin id = 49
40001 admin 15:18, 28th Dec 2012 plugin.php
40000 admin 15:11, 28th Dec 2012 plugin.php edit plugin id = 49
39999 admin 15:11, 28th Dec 2012 plugin.php update plugin id = 49
39998 admin 15:11, 28th Dec 2012 plugin.php edit plugin id = 49
39997 admin 15:11, 28th Dec 2012 plugin.php modify
39996 admin 15:10, 28th Dec 2012 template.php search
39995 admin 15:09, 28th Dec 2012 attachment.php types
39994 admin 15:09, 28th Dec 2012 attachmentpermission.php
39993 admin 15:08, 28th Dec 2012 image.php upload Avatars
39992 admin 15:07, 28th Dec 2012 plugin.php
39991 admin 15:07, 28th Dec 2012 plugin.php update plugin id = 49
39990 admin 15:07, 28th Dec 2012 plugin.php edit plugin id = 49

Any help would be appreciated.
Reply With Quote
  #2  
Old 01 Jan 2013, 10:43
borbole's Avatar
borbole borbole is offline
 
Join Date: Jan 2010
If I were you I would revert to the most recent backup prior to being hacked. Another thing would be to do a thorough check up of your server space for any backdoor files and the likes and overwrite all your forum files with a fresh set from a new vb package your forum version. Also it would be best to contact your host and to ask them to check their access logs for around the time of the hack to see if there will be any info as to how they got in.

P.s. What version of vb are you using btw? If you are not already using the latest version, it would be best to upgrade your forum a.s.a.p.
__________________
My mods.
Reply With Quote
  #3  
Old 01 Jan 2013, 11:04
Carnage Carnage is offline
 
Join Date: Jan 2005
the plugin probably edited some templates directly to put the redirect code in. If you don't have any recent backups, I'd suggest looking at the templates (maybe reimport your styles)
__________________
www.giveupalready.com

If you want/need to contact me, best thing is to pm me on that site, username Carnage.
Reply With Quote
  #4  
Old 01 Jan 2013, 14:19
airplane-dude airplane-dude is offline
 
Join Date: Oct 2005
Very is latest of 3.8.X (I posted this in the wrong section I guess, sorry)..

I will admit, my latest backup was quite sometime ago..

Is there a way to revert to the default templates?
Reply With Quote
  #5  
Old 01 Jan 2013, 17:25
Lynne's Avatar
Lynne Lynne is offline
 
Join Date: Sep 2004
Real name: Lynne
Upload tools.php to your /admincp and point your browser to it > login > Rebuild Master Style

Then create a new style with no parent:
  • Styles & Templates > Style Manager > Add New Style
  • Parent Style: No Parent Style
  • Title: Default vBulletin
  • Allow User Selection: Yes
  • Save
Then browse the site using that totally default vbulletin style - do you still have the same problem?
__________________
Former vBulletin.org Staff Member

Try a search before posting for help. Many users won't, and don't, help if the question has been answered several times before.
W3Schools -
Online vBulletin Manual
If I post some CSS and don't say where it goes, put it in the additional.css template.
I will NOT help via PM (you will be directed to post in the forums for help.)
Reply With Quote
  #6  
Old 02 Jan 2013, 01:40
airplane-dude airplane-dude is offline
 
Join Date: Oct 2005
Does doing the above get rid of the color schemes and look of the forums?

Can I save those colors and such, somewhere?
Reply With Quote
  #7  
Old 02 Jan 2013, 01:45
Max Taxable's Avatar
Max Taxable Max Taxable is offline
 
Join Date: Feb 2011
Originally Posted by borbole View Post
If you are not already using the latest version, it would be best to upgrade your forum a.s.a.p.
The version matters not at all if it's backdoor exploits installed by the admin via a style template. (Or any mod with such.)
Reply With Quote
  #8  
Old 02 Jan 2013, 02:38
Lynne's Avatar
Lynne Lynne is offline
 
Join Date: Sep 2004
Real name: Lynne
Originally Posted by airplane-dude View Post
Does doing the above get rid of the color schemes and look of the forums?

Can I save those colors and such, somewhere?
Rebuilding the Master Style will not touch your color schemes or modified templates unless you did something really strange and modified the master style instead of just creating and modifying a new style (very rare). You can always export your style first via Styles & Templates > Download/Upload Styles if you think you may have done that. Again, you would have needed to be in debug mode to do that in the first place which would be very rare for a regular vbulletin user.
__________________
Former vBulletin.org Staff Member

Try a search before posting for help. Many users won't, and don't, help if the question has been answered several times before.
W3Schools -
Online vBulletin Manual
If I post some CSS and don't say where it goes, put it in the additional.css template.
I will NOT help via PM (you will be directed to post in the forums for help.)
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


New To Site? Need Help?

All times are GMT. The time now is 06:24.

Layout Options | Width: Wide Color: