We’ve seen some clients VB boards attacked through a vulnerable module.
The problematic module is CYB-Advanced Forum Rules and you can find discussion regarding the attacks against the module in this thread on the VB forum. At one point in the discussion it appeared that the latest version of the module should fix the issue, but then as the thread goes on it appears that some clients still had problems after the upgrade. For that reason our recommendation is to disable this module and to watch the current discussions on it and only upgrade and re-enable it after a new updated module that has been written that is impervious to the attacks and has been thoroughly tested for awhile.
If you are attacked via this vulnerability please contact VertexHost support ASAP. We can help restore your site to a backup before the attack took place at no charge if you are attacked. Or if you prefer not to roll back but want our developers to help remove items that were changed during the attack we can help with that too at an hourly rate of $75.
Assuming that the hack is not any different then most of the ones we have seen the following instructions, as posted on the vb board by user vktechnology can be used to remove the hack:
Instruction how to remove
1) Search for new update file and delete it
go to your root forum
and run this command to fine new update file
login as shell
find . -mtime -1 -print
(-1 is day of update file)
you might see this file and delete it
index.php
index.html
admincp/index.php
admincp/index.html
modcp/index.php
modcp/index.html
and delete unknow files
and Upload load original files you just delete it
2)reset admin login to admin cp
upload tools.php to admincp
and reset admin login
3)login to admincp and disable Cyb rules and install new version do not foget to over write it
4)Go to phpmyadmin
go to Table: user
4.1delete everything in this field = usertitle
UPDATE user SET usertitle = ”
4.2update this field customtitle =0
UPDATE user SET customtitle = ’0′ where customtitle = ’1′
4.3. deelte user id that over ’13371337′
4.4 Table: user > AUTO_INCREMENT set number to you real latest user
5)Go to admincp > user group > adminstrators
Delete user that you didn’t add
6) admincp > update counter > update user title
this step you will get users title back
7) turn on board
—all done —