Forum keeps getting hacked

[woffie]

Somehow they are changing the forum.php, arcade.php and admin index.php file. Any ideas? 3 times in 2 days

[K a M a L]

They may have a rootkit uploaded somewhere in your server .

[Wayne Luke]

Most likely an extraneous file or a bad plugin. Plugins are usually attached to the vBulletin product so people ignore them. There should be no plugins assigned to the vBulletin product.

Following the steps here will secure vBulletin and eliminate it as the source of intrusion: http://www.vbulletin.com/forum/forum...ring-your-site

If you use FTP, you will want to switch to SFTP or FTP over TLS if you want security. FTP is not a secure protocol. Make sure to change your passwords. If you' use a cPanel based server your password for cPanel, SFTP and email should all be different. By default, they are all the same.