Preventative - How to avoid being Hacked by TeamPS i.e. p0wersurge

[The_Rascal]

Thanks Snakes,
New thread posted.

[meissen]

When I run the SQL query for base64 in plugins I get a long string under the subscriptions.php file... is that normal?

if (strpos($_SERVER['PHP_SELF'],'subscriptions.php')) { eval(gzinflate(base64_decode('-removed-'))); exit; }

[Zachery]

Not normal, remove that code or reupload a fresh copy.

[Inspector G]

I found a way they are doing this...

I also saw this somewhere I just cant remember where...
but i removed the whole install file after, I restored my site and nothing has happened so far...

To Access vBulletin use this
/install/upgrade.php
All You need is a Customer Number to Run the upgrade Script
Then once they upgrade...
They can access to admin CP then they upload
Whatever they want using XML and then they can access to the rest of sub-domains
This isn't made aware to the public they go on to say...

[BirdOPrey5]

That doesn't make sense, you are required to login to the admin cp with a username and password after an upgrade (if not already logged in), I just confirmed on my own test site.

That said for VB3/4 it is good practice to password protect the install and admincp directories. In VB5 the new rule is to delete the entire install directory.

[TheLastSuperman]

Delete the /install directory from vB4 as well, it is not required and furthermore is not needed unless it's being called forth by some administrative functions which is usually from tools.php if not one of the maintenance functions and if your site is running smoothly w/o errors there is usually no need to run those . If you go to do something in admincp and an error is given then simply temporarily reupload the install folder (minus the install.php file respectively) do your "function" then delete again .