it's hacked now at this moment. sending ya a pm RTMdotORG

okay.

They are not "hackers". They are normal users trying to manage subscriptions... vBFirewall is more effort than its worth.

well that's a relief.

--------------- Added [DATE]1230832971[/DATE] at [TIME]1230832971[/TIME] ---------------

well my site was put back up once again...
lass than 7 hours later....hacked AGAIN!!!
3 times in 3 days!!!!

www.ripthemic.org

1||1230777472||98.100.180.113||do=viewsubscription ||||Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5
1||1230777561||98.100.180.113||do=viewsubscription ||||Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.0.5) Gecko/2008120122 Firefox/3.0.5
1||1230816616||86.96.229.88||s=&do=add&dostyleid=1 0&title=headinclude&group=all&searchstring=&expand set=10||http://ripthemic.org/forums/admincp/||Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506)
1||1230816628||86.96.229.88||s=&do=add&dostyleid=1 0&title=headinclude&group=all&searchstring=&expand set=10||http://ripthemic.org/forums/admincp/||Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.0.04506)

wow - www.ripthemic.org/forums/

HaCked By : Sniper-3 | Devano |
__

# Black Hat's Crew #

MSN :
3-Z@Live.Com
__

Disable and uninstall all your modifications. Making sure you remove all files of those modifications. Also make sure there are no suspicious files hiding in any of the directories.

I went through the file system and removed alot of code and restored admin access. Got the site back up again. they made a mess over there. they injected into the database. they targeted index.html. index.php. login.php and removed RTMdotORG's admin acct. Renamed admincp.... chmodded a few files and did some work on the server. outside of needing a new index.html file, should be no problems now. forums are working. :cool:

yessir.
thank you.