Quote:
Originally Posted by Lynne
It may show in your access_logs. Each plugin has an id and when you go to edit it, it says the id in the url. So, like I said, look in your access_logs for something like "..../plugin.php?do=edit&pluginid=xx" to get the pluginid.
|
Yep, plugin edits can be tracked this way; but this entry :
Code:
17838 Python 18:04, 19th Apr 2009 plugin.php productedit
corresponds to a whole 'product' edit; whose ID we *probably* can't track. As vB doesn't log it and moreover, that ID is sent via POST not GET; so the server access log can't see it too.
To OP:
All the hacker used was just plugin edits ? Did you check with your webhost on which 'files' were altered/added to your hosting account in the past 1 week ?