Forum hacked via an Announcement

[Pierce]

Hello. Today someone hacked my forums via an Annoucnement that redirected to a blog. This is what was in the Annoucnement: <META http-equiv="refresh" content="1;URL=http://herform.blogspot.com/">.
I am currently running 4.2.0. Any ideas on ways what I can do to prevent this? I do plan on upgrading soon but it may not be right away. Should I disable some features? Just not sure where to start yet and how that happened.

Also I just read the notice about removing the install directory. Just did that too.

[stryka]

I think you answered your own question... read the blogs on other steps on how to cleanup after the deletion

Also I just read the notice about removing the install directory. Just did that too.

[Pierce]

Yes I am reading that now. Still working on it. Thanks.

[Wayne Luke]

First you need to follow our advisory about deleting the install folder off your forums.

Then please read the following two blog posts:

http://www.vbulletin.com/forum/blogs/zachery/3993888-fixing-your-site-after-you-have-been-hacked

http://www.vbulletin.com/forum/blogs/zachery/3993849-best-practices-for-securing-your-vbulletin-site

Also please see these recent security announcements:

vBulletin 4.1.x-4.2.x & All versions of vBulletin 5: http://www.vbulletin.com/forum/forum...-1-vbulletin-5
vBulletin 5.0.x patch released, for a different security issue: http://www.vbulletin.com/forum/forum...d-all-versions

[samdu]

Okay, I'm having the same issue and being redirected to the same site (herblog.blogspot.com). But there are no announcements active on my site. What's the fastest way to find this redirect and eradicate it?

[donald1234]

Okay, I'm having the same issue and being redirected to the same site (herblog.blogspot.com). But there are no announcements active on my site. What's the fastest way to find this redirect and eradicate it?

Waynes post above delete your install folder and any rogue admins then follow the above advisories.

[Wayne Luke]

Okay, I'm having the same issue and being redirected to the same site (herblog.blogspot.com). But there are no announcements active on my site. What's the fastest way to find this redirect and eradicate it?

AdminCP usually doesn't have any issues with template insertations or plugins. It is a little isolated that way. You can disable all plugins in your config.php file and see if that helps.

Please disable all plugins on your board and tell us if the problem persists.

To do this, edit your vBulletin config.php file currently on the server by adding the following line after the <?php line:

define('DISABLE_HOOKS', true);

Then reupload the config.php file into your forum's includes folder.

[samdu]

I found it, guys. It was just a redirect line placed in the header. Much easier to expunge than I expected (and had I known, I wouldn't have been searching everywhere else ). Thanks for the suggestions.