MyBB Community Forums

Hello!

I'm having some issues with my forum's security and cpanel password.

As indicated in this thread my forum was infected and i couldn't log into my cpanel. The uploaded files were:

[attachment=40718]

[attachment=40719]

As soon as i knew the issue, formatted my pc even if i don't use any strange programs on it,i changed the password to my email linked to the hosting company,i changed the password to access the client area and i changed the cpanel password.

I also checked if there were some usergroup or user having admin as additional usergroup,everything was ok.

After a week,i wanted to upload some files via filezilla and the password didn't work.Really strange,i contacted the hosting company regarding this issue and they told me the most common things like how to protect myself ecc ecc.

I re-changed the password yesterday and checked if the root directory was clean and it was clean.

Today,i wanted to check if everything was ok,what i found is that my password to cpanel has been changed again.


I did a password reset again and i saw some .eur directory in the root directory ,deleted it again.

So,my question is,what is going on?

From my side,i can say,i am using an antivirus,a firewall,no strange programs running on my pc.I don't store even cookies / passwords or usernames in browser.

Then why is my cpanel password changed and how is it changed?

My forum's password is intact and i'm not having any issues there for the moment.

I'm suspecting that the hosting company is having security issues..

What are your point of view?

Please help as i don't want to lose my forum.

Thanks in advance.

Scan using Succuri scan

https://sitecheck.sucuri.net/

[attachment=40721]

I think someone has hijacked your domain and website.

You need to contact your hosting company and tell them what is going on.

I already told them about that ,they suspect that it could be caused by some insecure plugins.They didn't take any more steps.

(2018-08-15, 01:04 PM)kingkong Wrote: [ -> ]I already told them about that ,they suspect that it could be caused by some insecure plugins.They didn't take any more steps.

Non-secure plugins? 

That does not make any sense.

I would recommend you find another hosting company.

That hosting company is not helping you at all. 

This is what they said.

[attachment=40722]

---

Any suggestions?Any help?

What could be causing it if the pc i use is ok,antivirus installed,firewall installed,complex passwords are being used,i don't save my passwords on a text file.

I am already considering to change the hosting company but i'm afraid if the problem is inmy database,the changing of hosting company wouldn't help.

Do you go through your domain to get to cPanel (e.g. by adding /cpanel or similar to the end of the URL) or the host's domain?
It's possible for someone to setup a fake cPanel to proxy you through.

No,i have a different url to visit the cpanel.(Host domain)

I have replaced every single file with the fresh default one but the cPanel password was changed again this morning.

I just didn't replace the plugin files,they are the old ones.

Really,i can't understand what is going on.

I think it is time to change the hosting company...