HACKED and don't know what to do..

[CSU-CYS]

Terrible day for me and our community.
I run a BB for a non-profit called the Cystinuria Foundation of America, Inc. We're slowly updating our website to reflect the recent incorporation. Just went online today and found that my forum page had been hacked.
You can visit it (not much to see, really) at www.cystinuria.org/forums

I'm locked out of my own admin account... and i'm worried that everything's gone. I'm really not the best at this kind of thing, and basically knew enough to set the BB in place and operate it. I am very upset and at a total loss of where to begin fixing this problem. I don't know why someone would hack our little site... we just try and help people with a disease.
Can anyone please help someone very much in need??
Rock bottom here... any advice would be so greatly appreciated.
Kind Regards,
matt lewis

[Mephisteus]

Can you log into ftp if not can you contact your webhost to reset your login data? Did you keep backups?

[CSU-CYS]

Thank You

Hi, thank you for the reply.
I can't get into the ftp for the site, nor can i access Vbulletin by going to www.cystinuria.org/forums/admin. Says my admin logon is incorrect.

I tried to back up once, but it didn't go so well. I may or may not have a backup at this point. I'm not worried about the posts though, mainly the members. We had a small group (100 exactly), and i'm really hoping that their membership is still active once i get the board back up.

Ideas?
Thanks again,
matt lewis

[Steve Machol]

<moving to vB2 forum>

You are running vB 2.3.0 which has known security holes that this hacker took advantage of. Please read this important announcement about a security issue with your version of vB:

http://www.vbulletin.com/forum/showthread.php?p=694180#post694180

Fill out a support ticket at:

http://www.vbulletin.com/members/membersupport_contactform.php

Be sure to include the login info to your Admin CP, phpMyAdmin and FTP.

If they have not deleted any data we may be able to restore your forums. Otherwise you will need to restore a backup of the database, if you have one.

[CSU-CYS]

Thank you Steve, you've always been very helpful and kind.
I'll get on that as soon as i can get away from my work for a few...

Thanks again... so very much
kind regards,
matt

p.s. sorry about the wrong forum... thank you for moving

[Steve Machol]

If you fill out a support ticket. ask that it be assigned to me. I've worked on a number of these hacked forums and no what to look for.

[CSU-CYS]

Thank you again Steve.
Looks like i'll have to renew my licence and add members area access. Will do ASAP.

[99Percent]

I got hacked. My fault for not upgrading on time.

The recorded ips are 212.138.47.11, 212.138.47.29, 212.138.47.20, 212.138.47.17, 212.138.47.16 22/JAN/2005 06:32 CST

He first did a yahoo search for "powered by vbulletin" with the version number

[teach1st]

Interesting. I've had 212.138.47 blocked for a long time on both of my boards. I don't remember how I knew to block it.

Saudi Arabia, right?

[99Percent]

Can these IP's be spoofed?

I also got a couple of hotmail accounts that he used, one for the new member register, and another where he reset the administrator's email, not sure if they are of any use.

[DelphiVillage]

those are proxy servers a "real hacker" isn't stupid to leave his real ip behind he .... you should contact your host as they are the only one who can properly help you also if possible you should atleast ones a week read vbulletin.com so you know about security holes and howto patch them looks like you have been the victim of a fool who whas trying to be interesting