Forum Site hacked by P0wersurge.com user(s)
 

Hi,

My forum was hacked on the 26th October, my admin account was hacked, and the ftp passwords changed.
After eventually getting our hosts to change the password, I was finally able to start work on the repair.

I have looked at the p0wersurge deface thread and run all the counter measures mentioned, except for the htaccess ones listed at the bottom (still to do)

All plugins and products have been removed, and a fresh upgrade of vb4.2PL3 has been made.
However, there are still some spurious files listed in the admincp|Statistics & Logs|Transaction Log (MySQL Tool) and under the Maintenance|Diagnostics (MadShell) (See attached pics)

I have edited my config.php to run the 'disable hooks' code, and the above files seem now to be disabled.

I have scanned my existing .htaccess file and the only thing in there is a redirect to my index.php - so that looks ok

I have downloaded all the ftp files and run a virus scan on them, and they were clean.

One member has suggested running the following: -

Quote:
Originally Posted by snakes1100 http://vb.ma7room.com/images/buttons/viewpost.gif
If the files are scanned & verified as clean, w/ either a tool or because you have deleted all files & replaced them, including htaccess files, then you will need to scan the DB & verify its clean as well, id start by scanning the db for ifram, exec code in your template & plugin tables.


Trouble is I am not that clued up on running queries on the database, I can do it if I know the query format to run, but am unable to write the query myself. If the above queries mentioned are the ones listed in the p0wersurge thread, then they have already been undertaken.

If anyone can offer any further advice on how to remove the tools, it would be very much appreicated.

Thanks

James
Attached Images

• https://www.vbulletin.com/forum/images/attach/jpg.gif mysqltool.jpg‎ (171.1 KB)
• https://www.vbulletin.com/forum/images/attach/jpg.gif madshell.jpg‎ (222.5 KB)