My forum was hacked by a linkbucks redirection link and also cannot access the admincp, but I can access the cpanel, how to remove the hack?
Hacked by ************* link
Collapse
X
-
The IM Forum - Where All Internet Marketers Come Together - http://www.theimforum.comTags: None -
See :
This guide is for what to do, after youve been hacked, exploited, and or defaced. Step 1, Change everything: If you believe, or think your site has
I wrote a 10 page guide (http://vbtechsupport.com/2355/) for VPS and dedicated hosting users on my personal blog (http://vbtechsupport.com/2355/) outlining my how I'd handle cleaning up hacked vBulletin forums
Also if you you've vBSEO make sure that you've the latest version -
I replaced all files and do the upgrade process but it still do not solved the problem.The IM Forum - Where All Internet Marketers Come Together - http://www.theimforum.comComment
-
I could reach the admincp, but when I click login it direct me to the forum homepage and not the admincp, then the redirection happen again.The IM Forum - Where All Internet Marketers Come Together - http://www.theimforum.comComment
-
If you have a VPS/dedicated server look at http://www.vbulletin.com/forum/blogs...ting-ssh-users for more detailed analysis of your infection status. The guide also has other useful tips
i.e. for your instance check your templates and htaccess files for malicious redirects i.e. header/footer templates etc.:: Always Back Up Forum Database + Attachments BEFORE upgrading !
:: Nginx SPDY SSL - World Flags Demo [video results]
:: vBulletin hacked forums: Clean Up Guide for VPS/Dedicated hosting users [ vbulletin.com blog summary ]Comment
-
The hacker actually take over the admin account, I have since take over and add password to admincp page, the hack code is placed in one of the ad location and I disabled it, everything is fine now.The IM Forum - Where All Internet Marketers Come Together - http://www.theimforum.comComment
-
Ok the hacker has return but this time he is unable to use admincp but add a code to public_html/index.php, it seems that he is not using cpanel to alter the file, any idea how he do it?? So I can plug the hole, by the way I am using VPS hosting.The IM Forum - Where All Internet Marketers Come Together - http://www.theimforum.comComment
-
Is there any way or log where I can check how the hacker get access and edit public_html/index.php file?
public_html/index.php permissions is 0644, should I change to 0755 to prevent someone altering it?Last edited by theimforum; Tue 8 Oct '13, 10:59pm.The IM Forum - Where All Internet Marketers Come Together - http://www.theimforum.comComment
-
I have secured the admincp and now I have changed the hosting account password also, let's wait and see whether the hacker will be back. Also have set index.php and forum.php permissions to 0755Last edited by theimforum; Wed 9 Oct '13, 2:24am.The IM Forum - Where All Internet Marketers Come Together - http://www.theimforum.comComment
-
After I have done the above steps the hacker still can edit the index.php, anyone has any idea how to stop him?The IM Forum - Where All Internet Marketers Come Together - http://www.theimforum.comComment
-
Just found a suspicious file something like shell.php, compared with default files in /upload and found no such file, just deleted it, and changed cpanel password again, hope everything is fine from now on.The IM Forum - Where All Internet Marketers Come Together - http://www.theimforum.comComment
Related Topics
Collapse
-
by citrixCan't access AdminCP via clicking the link - always need to enter "core" manually - how can i fix this? I dont want always to modify the URL in order to can access my admincp
thank...-
Channel: Support Issues & Questions
-
-
by Kent55When I try to access the adminCP I am given this error:
That action could not be completed. Please try again, and if this occurs again please contact the system administrator and tell them...-
Channel: Support Issues & Questions
-
-
by oxegenGood morning.
I have done a fresh install of vB 5.0.2 on a new server; all has gone well except I cannot get to admincp. I can get to /core/admincp and login, and the forum itself works correctly,...-
Channel: Support Issues & Questions
-
Comment