Forum was hacked and have this error message

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • USABOT
    New Member
    • Jun 2013
    • 12
    • 4.2.X

    Forum was hacked and have this error message

    Our forum was hacked and we did all the tasks to clean it up. After going through and removing all the Index.php files that were dated and time stamped at the time of hack. I now have the following error message when I try to login to the forum or admincp

    Unable to add cookies, header already sent.
    File: /hermes/bosoraweb010/b87/ipg.usabot/public_html/tanker/includes/config.php
    Line: 1

    Not able to do a restore from backup as this is also the files from the hacked files from the first hack from the day before.
  • USABOT
    New Member
    • Jun 2013
    • 12
    • 4.2.X

    #2
    Any help here?

    Comment

    • kat00
      Senior Member
      • Dec 2006
      • 259
      • 4.0.0

      #3
      Your first line on your config.php will have been tampered with, replace that file with your DB info and everything else that is supposed to be there.
      Check suspect file versions. There will be a suspect file called wso.php
      Delete that file and delete the plugin called VBULLITEN, have a look at the Plugin PHP code and you will see why. It's not a native plugin, it is a hack

      AND CAN SOMEONE TELL ME HOW THESE BASTARDS KEEP DOING THIS, WE HAVE TAKEN ALL THE PRECAUTIONS RECOMMENDED

      This one is different to the one we had a few days ago, exactly the same symptoms but different source.

      Last edited by kat00; Tue 24 Sep '13, 8:16pm.
      ttttt

      Comment

      • borbole
        Senior Member
        • Feb 2010
        • 3074
        • 4.0.0

        #4
        How were you hacked? When you say the backup files were infected did you mean forum files or the db backup?

        Comment

        • USABOT
          New Member
          • Jun 2013
          • 12
          • 4.2.X

          #5
          It was the Server directory that included the Forum Files/Directory and Website Files. We had an file called index.php in every directory/subdirectory. We restored the Forum Directory from the Backup and was working on following the instructions for cleaning it up. 24 hours later we was hit again Webmaster cleaned website files of above file and restored files from a backup he had. Restored forum files again from backup, but the backup had this index.php file. So started clearing those out and then ended up with the above message. Website hasnot been hit again, but forum has not be accessable even by me

          Comment

          widgetinstance 262 (Related Topics) skipped due to lack of content & hide_module_if_empty option.
          Working...