UBB.Dev
Posted By: tgreene *** HELP -- I've been hacked *** - 01/23/2006 6:01 PM
Bizarre as it may be, one of my Admins (part owner) just scrambled the boards and changed the Primary Paths, so I can't even log in and change anything back.

I have no clue as to what he was thinking, but according to the log file, he turned off the forums, tried to mass move and nuke all threads posts, change user access, etc.

I'm about to have a heart attack this morning!!!

I did restore a backup of my member file, so I'm back to normal, as well as block him via HTACCESS at the root level.

If anyone could please help me locate a file where I can change this back, I would be forever indebted.

Tim Greene
870-627-0594
Posted By: Ron M Re: *** HELP -- I've been hacked *** - 01/23/2006 6:59 PM
You need to download and edit vars_config.cgi. Once you fix the paths, upload and it should work. If you cannot get it to work, you will probably want Groupee Support to help you further as it will require FTP Access to fix your boards.

On a side note, this particular forum is reserved for Suggestions for Modifications, not I've been hacked posts. You would probaby want to post these type of questions down in New Member Questions in the future smile
Posted By: tgreene Re: *** HELP -- I've been hacked *** - 01/23/2006 7:35 PM
THANKS, it worked perfectly!

FWIW: The very first thing I did when I discovered what happened this morning, was to FTP in and remove the cache file that instructions to NUKE every post and thread, via pruning... Thank God he didn't think to clear the cache, otherwise we would have been dead in the water.

Absolutely everything is immediately back to being 100% recovered!
Posted By: AllenAyres Re: *** HELP -- I've been hacked *** - 01/24/2006 12:26 AM
quick recovery... tho hopefully your host woulkd have backups as well smile
Posted By: Gizmo Re: *** HELP -- I've been hacked *** - 01/24/2006 12:56 AM
FYI, clearing the cache when things have been deleted isn't good, leave the cache as it contains all cached posts and is the only way to recover data if it had been removed from your server...
Posted By: tgreene Re: *** HELP -- I've been hacked *** - 01/24/2006 6:52 PM
Quote
Originally posted by Gizzy:

FYI, clearing the cache when things have been deleted isn't good, leave the cache as it contains all cached posts and is the only way to recover data if it had been removed from your server...
What I was trying to say was, that he nuked everything, yet he FORGOT to clear the cache (completing the deletion process)... There was a MassMove-Delete TEMP file that I noticed when I FTP'd in, so I pulled it down as saved it "just in case". It appears that everything may have in fact been nuked the next time the server did it's auto-caching thing, and without that instruction file, we dodged a bullet.

I spent all yesterday, half the night, and the past couple of hours this morning transferring everything to a '.NET' domain that I solely control, to remove the potential of this ever happening again. I re-directed the domain where this site was held, to the new one.

I am however receiving a SERVER 500 ERROR when I turn on the pHp Accelerator or try to test the script... Any ideas..?

For the record; before transferring the UBB software, I contacted Groupee and was told to do it, in order to protect the board!
Posted By: Ian Spence Re: *** HELP -- I've been hacked *** - 01/24/2006 9:06 PM
Depending on the server, it might need to have it's permissions updated. Also, you might need to go to the paths page in the control panel, and submit the page again.
Posted By: Ron M Re: *** HELP -- I've been hacked *** - 01/24/2006 9:29 PM
With a 500 Internal Server Error, you should check your apache error_log file to see why this error is being generated.
Posted By: tgreene Re: *** HELP -- I've been hacked *** - 01/24/2006 11:08 PM
The host just corrected the problem... smile
© UBB.Developers