my forum got hacked and delete

we know the feeling, we all lost something one day, and crashing a forum because of no backup is seen here once per week at least...

your only thing is to re-install your forum entirely, with a clean version, and put an announcement or a notice for all to invite your active users to re-register because of the database death...

did the cracker deleted the entire database, or just the forum content?!

[geevest.com]

my support host say :

Hello,

I logged into the server and verified that the daily, weekly, and monthly
backups were all dated February 18, between 1:00 and 3:00 am. You can see the
backups here:

/backup/cpbackup/daily
/backup/cpbackup/weekly
/backup/cpbackup/monthly

[snakes1100]

weekly & monthly backups are just that, weekly and monthly, they should not be over written on a daily basis.

from the sounds of it, your host dont have the backups set correctly in cpanel, i assume the great techs at LW set the server up for you?

[geevest.com]

well they dont hack my forum site.
they just delete any room category in my forum.
they logged in as admin and deleted the forum category.

[ssslippy]

Based off the fact that your weekly monthly and daily backup are all the same u are out of luck. You can check for previous backups I doubt they are there. Your backup schedule also should keep a full weeks(each daily) of data so u can roll back to a non corrupted.

[snakes1100]

Well, as slippy put it as well as myself, the backup system was setup incorrectly in cpanel, it didnt retain anything, it simply was over writing everything on a daily basis, the LW tech that staged this server and setup the backup system, screwed the pooch.

Here is another brief story about LW and its not to bash them, it may be only a few of them that are inept.

Member here gets new server, LW sets up firewall, server runs for crap for 5 days, high loads, users cant get in etc, techs battle this for 5 days!

LW keeps telling her, you need more RAM, here is a price quote for 16gb's 24gb's & 32gb's, mind u she already has 8gb's of RAM lol.

To keep it short, i disabled the firewall addon script ddos.sh (addon for APF) and all was well.

As i stated this isnt to bash LW, i had always heard good things about them, the point is, everyone, you need to make sure your backups are working and that you download them to your computer at home/work or to where ever, do not depend on a 2nd drive, do not depend on a NAS at the host, always get your own copies on a daily basis.

[geevest.com]

hi snakes1100,.thank you very much for helping me.
but now im wait my host.
i dont know this issue is fixed or not. i will give information again in here.

here what my support say :

We have a database backup from Feb 18 02:15 for the reza_forum database that
is 213M in size if you would like us to restore this data. The servers backup
system rotated all weekly and monthly archives at that time so nothing older
than that is currently present on the system.

they have my backup database feb 18. 02:15
i hope my database back again.i really pray to god
btw i dont know why if i lost my forum and must restore from 6months ago.
thats very sick . i hate it. i build my forum in 1year.

--------------- Added [DATE]1234982993[/DATE] at [TIME]1234982993[/TIME] ---------------

oh damn*d my support say :

Per your request the rez_forum database backup from Feb 18 02:15 has been
restored. I understand this may not be helpful but it is the only backup data
present on the backup drive. As it has been explained previously, the cpanel
backup function rotated your weekly and monthly backup archives last night.
Here is a listing of the timestamps on each backup file for the reza user:

-rw------- 1 root root 6.4G Feb 18 02:34 /backup/cpbackup/daily/reza.tar.gz
-rw------- 1 root root 6.4G Feb 18 02:34 /backup/cpbackup/monthly/reza.tar.gz
-rw------- 1 root root 6.4G Feb 18 02:34 /backup/cpbackup/weekly/reza.tar.gz

Unless you have an alternate backup source this is all we have to restore your
data from.

[TNCclubman]

you might be able to restore some of it so all may not be lost.

Re-install vBulletin from fresh. Then open up the database they have backed up for you, even if its only half and the rest is lost. check which tables are complete in the backup, copy them to the clipboard, delete the table in your vBulletin with phpmyadmin, and run an sql query in the database (with phpmyadmin) by pasting what you have copied (the single table) in the big white square and click 'write'

Some parts may be saved this way instead of starting over. Hopefully your user table was in tact, thats the most important.

[UKBusinessLive]

So Sad when something like this happens especially with a large site with a regular income

The Thing to do, what i do is at least i make a full CPanel Back up and then i download the backup file onto my memory stick and that goes into my safe.

Once a week i do this, you can never reply on your host as this shows, Are you prepared to lose everything because you didn't take 5 minutes to make a remote backup.

Do it Now, go on Make a full backup and burn it to a cd or memory stick and keep it safe.

As for the OP, I hope you can Salvage what you can, My thoughts are with you

[Kaelon]

Out of curiosity, do you we know how this forum got hacked? Are other vBulletin forums vulnerable to this?