[GoTTi]

a forum was hacked, and the owner gave me this info:

9655 Virus20 09:36, 8th Oct 2002 backup.php csvtable Table = usergroup 129.93.14.65
9654 Virus20 09:35, 8th Oct 2002 backup.php csvtable Table = user 129.93.14.65
9653 Virus20 09:35, 8th Oct 2002 backup.php choose 129.93.14.65

Then on another forum, this was found...

7937 Hangover 09:38, 15th Oct 2002 backup.php csvtable Table = user 129.93.14.65
7936 Hangover 09:38, 15th Oct 2002 backup.php choose 129.93.14.65
7935 Hangover 09:37, 15th Oct 2002 index.php 129.93.14.65

After this was posted in our forum questioning the hacking, a user posted this saying it was in his admin log:

2145 Cleaner 21:00, 13th Sep 2002 backup.php csvtable Table = usergroup 129.93.14.65
2144 Cleaner 20:59, 13th Sep 2002 backup.php csvtable Table = user 129.93.14.65
2143 Cleaner 20:59, 13th Sep 2002 backup.php choose 129.93.14.65

What is this and do any of you guys have this in your admin logs?

If this is a exploit within vB, some1 needs to get ontop of it.
According to several users, this person @ this IP is hacking. But not jumping conclusions, Internet users can now use program to mask their IP, so I am not assuming that this IP (which leads to a EDU account) is actually "hacking" forums. I assume that this box alone is hacked and is being used as a proxy to be annonymous online.

Anyways, please check your admin logs for this IP.