| T O P I C    R E V I E W | 
              
                | TastyNutz | Posted - 19 May 2012 : 17:42:42 This concerns my Serverhacker (SHN Forums) and I wasn't sure of the appropriate place to to post.
 
 At one point today my site wouldn't load properly and I couldn't login.  It basically looked like an HTML page with a missing style sheet.
 
 I had to recycle the application pool and then the site was fine.
 
 But I then found a spammer somehow managed to post several new topics and a reply under an existing username without leaving any other traces of having been there.  The username hasn't been used in years (last visit 2007) and doesn't show as a recent visitor.  The user IP address also doesn't appear to have changed from the last visit in 07.
 
 I rarely get spam and it's usually a manually registered account.  So, even though this is just a minor irritant, I'm intrigued as to how it was done.
 
 My forensic skills are limited so any suggestions on where to look would be appreciated.
 | 
              
                | 3   L A T E S T    R E P L I E S    (Newest First) | 
              
                | TastyNutz | Posted - 19 May 2012 : 22:50:52 Thanks again!
 | 
              
                | ruirib | Posted - 19 May 2012 : 18:36:47 Actually, no forensic skills are needed. Your situation, resulting from app variables being lost, is known and there are fixes :
 
 http://forum.snitz.com/forum/topic.asp?TOPIC_ID=67497&whichpage=2
 | 
              
                | TastyNutz | Posted - 19 May 2012 : 18:12:45 Correction... The Last IP in the Members table didn't change, but T_IP in the topics table did.  At least now I have an IP and can block it.
 |