| Author |
 Topic  |
|
mdelcour2000
Junior Member
United States
133 Posts |
 Posted - 27 January 2008 : 22:30:55
|
| ok, something funky is going on. I replaced my files last night. Today I log on only to find that the forum has been hacked again, with the same message. This time however, I can't shut the forum down. I press the "stop the board" button, and it won't stop it. I guess I am going to have to delete my database and start over there too. Anyone have any ideas? |
http://lacledeforum.com/
"Never get so busy doing the work of the kingdom that you forget who the King is" |
 |
|
|
mdelcour2000
Junior Member
United States
133 Posts |
Posted - 27 January 2008 : 22:33:27
|
| ok, I finally got the board to shut down. Fixed that. But how is this person still getting in? |
http://lacledeforum.com/
"Never get so busy doing the work of the kingdom that you forget who the King is" |
|
|
|
phy1729
Average Member
USA
589 Posts |
Posted - 27 January 2008 : 22:40:12
|
| Did you check for admins you don't know? |
|
|
|
mdelcour2000
Junior Member
United States
133 Posts |
Posted - 27 January 2008 : 22:42:29
|
| yes, and I locked them. I really don't want to delete them, as they can just do it again. I really don't know what to do! |
http://lacledeforum.com/
"Never get so busy doing the work of the kingdom that you forget who the King is" |
|
|
|
mdelcour2000
Junior Member
United States
133 Posts |
Posted - 27 January 2008 : 22:45:47
|
| I have 2 more forums that I run, I am just praying this person dosen't figure out that I own them too and do something to them! |
http://lacledeforum.com/
"Never get so busy doing the work of the kingdom that you forget who the King is" |
|
|
|
muzishun
Senior Member
United States
1079 Posts |
Posted - 27 January 2008 : 22:48:20
|
quote:
Originally posted by mdelcour2000
yes, and I locked them. I really don't want to delete them, as they can just do it again. I really don't know what to do!
Since you have overwritten all of your forum files with new ones from the download, the security hole they used to get in the first time has been filled. You should be able to safely delete any hackers' accounts. Still, setting their member level to regular member and locking them should suffice. |
Bill Parrott
Senior Web Programmer, University of Kansas
Co-Owner and Code Monkey, Eternal Second Designs (www.eternalsecond.com)
Personal Website (www.chimericdream.com) |
|
|
|
mdelcour2000
Junior Member
United States
133 Posts |
Posted - 27 January 2008 : 22:51:41
|
| ok, I replaced the files yesterday, and then they hacked again since then. Since, I have locked their accounts (there were 3 this time)I should not have any more problems correct? |
http://lacledeforum.com/
"Never get so busy doing the work of the kingdom that you forget who the King is" |
|
|
|
muzishun
Senior Member
United States
1079 Posts |
Posted - 28 January 2008 : 00:24:12
|
| If you are running a clean install of Snitz without any mods, they should not be hacking in so easily through the forum. I am less experienced with tracking this sort of thing through server logs, but perhaps HuwR or ruirib could weigh in with some advice. But I don't believe they are getting in through the forum (at least, I would hope not). |
Bill Parrott
Senior Web Programmer, University of Kansas
Co-Owner and Code Monkey, Eternal Second Designs (www.eternalsecond.com)
Personal Website (www.chimericdream.com) |
|
|
|
HuwR
Forum Admin
United Kingdom
20600 Posts |
Posted - 28 January 2008 : 02:08:36
|
quote:
Originally posted by mdelcour2000
ok, I replaced the files yesterday, and then they hacked again since then. Since, I have locked their accounts (there were 3 this time)I should not have any more problems correct?
do you have all the Latest fixes ?
did you remove any/all bogus accounts with admin status ?
if you have done all the above then we can only help if you can supply us with the IIS log files for the time you were hacked. |
|
|
|
ruirib
Snitz Forums Admin
Portugal
26364 Posts |
|
|
philwhite
Starting Member
Germany
47 Posts |
Posted - 28 January 2008 : 05:23:00
|
| Just a quick point. Whenever I get spammers or, in this case, a hacker, I never delete the account. I just lock it. It adds an additional hurdle because they have to use a different (existing) email address. That doesn't mean much in these days of multiple addresses, but it's another hurdle. Is there any advantage to actually deleting their account? |
Phil White |
|
|
|
HuwR
Forum Admin
United Kingdom
20600 Posts |
Posted - 28 January 2008 : 07:26:56
|
quote:
Originally posted by philwhite
Just a quick point. Whenever I get spammers or, in this case, a hacker, I never delete the account. I just lock it. It adds an additional hurdle because they have to use a different (existing) email address. That doesn't mean much in these days of multiple addresses, but it's another hurdle. Is there any advantage to actually deleting their account?
None whatsoever  we also recomend locking bogus accounts rather than deleting them |
|
|
|
mdelcour2000
Junior Member
United States
133 Posts |
Posted - 28 January 2008 : 19:08:49
|
| I locked the accounts deleted their posts, deleted all snitz files and re-loaded them, and then locked the board. Again, they have hacked the site, unlocked it, and reposted their junk. I really don't know what's going on. It is hosted on a GODADDY server, I have contacted them. They are the only ones that have access to the IIS Logs. I asked several times. They are launching an investigation, however, my forum is still getting hacked, and I don't know what else to do. I am not understanding, how they are doing this. |
http://lacledeforum.com/
"Never get so busy doing the work of the kingdom that you forget who the King is" |
|
|
|
ruirib
Snitz Forums Admin
Portugal
26364 Posts |
Posted - 28 January 2008 : 19:58:41
|
You sure you removed all bogus admin accounts? That seems very, very weird. If there was a Snitz related issue we would be having serious trouble elsewhere too. Anyway, without the logs it's hard to do something...
|
Snitz 3.4 Readme | Like the support? Support Snitz too |
|
|
|
HuwR
Forum Admin
United Kingdom
20600 Posts |
Posted - 29 January 2008 : 01:57:03
|
you say you deleted all snitz files and re-loaded them, so once again I will ask.
DO YOU HAVE ALL THE LATEST FIXES
also as requested if you send us the iis logs we can work out what happened, it is unlikely that anyone who is unfamiliar with the forum code will be able to tell you what happened, so it is in YOUR interest to get us a copy of the log files
|
|
|
|
Topic |
|
Topic Locked
