Go Back   vb.org Archive > vBulletin 4 Discussion > vB4 General Discussions
Reload this Page Site hacked by Myanmar Muslim Cyber Force
FAQ Members List Calendar Search Today's Posts Mark Forums Read
  #31  
Old 09-15-2013, 03:00 PM
sr20de_99 sr20de_99 is offline
 
Join Date: Mar 2012
Posts: 14
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quick question, I've turned my forums off in the AdminCP while I've been cleaning up after the hack. However when I go to my site I can see that there are several guests who appear to be accessing various parts of my forums. But when I try to access my site as a guest, I receive the message that the forums are off line, and I can't access anything. Has anyone else notice this?
Reply With Quote
  #32  
Old 09-15-2013, 03:05 PM
ozzy47's Avatar
ozzy47 ozzy47 is offline
 
Join Date: Jul 2009
Location: USA
Posts: 10,929
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
They should have he little lock icon next to their usernames, if they are attempting to view the site while it is closed.
Reply With Quote
  #33  
Old 09-15-2013, 03:19 PM
Paul M's Avatar
Paul M Paul M is offline
 
Join Date: Sep 2004
Location: Nottingham, UK
Posts: 23,748
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by teamemmenracing View Post
and from nowhere this file appears .....

zdberrb4476bf0aed19d1e05964d0757f51.dat

it doesn't look legit, I managed to open it up and the only contents were a number .....

13790115241146
That is a legitimate file.

It created when you have a database error - to track the time and error code (1379011524,1146). This is used to limit the number of database fail e-mails sent.
Reply With Quote
  #34  
Old 09-15-2013, 05:41 PM
tnedator tnedator is offline
 
Join Date: Aug 2007
Posts: 43
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by pityocamptes View Post
I would get a hold of a clean version of you entire root download it to your desktop, along with the corrupted files (entire root files) and compare the corrupted version to the clean version you have before the hack...
Can you recommend a good Windows compare tool that would compare all the files in both forum root directories and highllight the differences?
Reply With Quote
  #35  
Old 09-16-2013, 03:38 AM
pityocamptes's Avatar
pityocamptes pityocamptes is offline
 
Join Date: Apr 2010
Posts: 595
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by tnedator View Post
Can you recommend a good Windows compare tool that would compare all the files in both forum root directories and highllight the differences?
I've used winmerge before, its pretty good...

http://alternativeto.net/software/me...atform=windows
Reply With Quote
  #36  
Old 09-16-2013, 09:43 AM
Phat Phreddy Phat Phreddy is offline
 
Join Date: May 2013
Posts: 10
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Has anyone recovered from this without reverting to an earlier database ??

I have securi saying all files are clean.. I have the install folder gone.. Of course removed the admins and stuff.. But I am still being taken out..
Reply With Quote
  #37  
Old 09-16-2013, 02:31 PM
pityocamptes's Avatar
pityocamptes pityocamptes is offline
 
Join Date: Apr 2010
Posts: 595
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
Quote:
Originally Posted by Phat Phreddy View Post
Has anyone recovered from this without reverting to an earlier database ??

I have securi saying all files are clean.. I have the install folder gone.. Of course removed the admins and stuff.. But I am still being taken out..
I would compare the db and files (corrupted) to a known clean set before hack. At least you could determine what files are modified, which you could eliminate...
Reply With Quote
  #38  
Old 09-17-2013, 07:44 AM
Spangle Spangle is offline
 
Join Date: Jun 2011
Posts: 520
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
If you are running a portal check the index.php file, when mine was hacked this was re written.

In fact you need to check the index.php file anyway.

also look for any txt files in the root, I found a couple, also look for a file called mail.php, this was re-writing the index.php file even after I'd uploaded a clean version
Reply With Quote
  #39  
Old 10-04-2013, 05:25 PM
SupportAM SupportAM is offline
 
Join Date: Nov 2006
Posts: 28
Благодарил(а): 0 раз(а)
Поблагодарили: 0 раз(а) в 0 сообщениях
Default
how do you check the logs? I upgraded to 4.2.1 and it is through cms

--------------- Added [DATE]1380912104[/DATE] at [TIME]1380912104[/TIME] ---------------

Okay I got it ! They messed up the forum home template. I replace with the older style.
Reply With Quote
Благодарность от:
findingpeace
Reply
Page 4 of 4 « First 23 4

« Previous Thread | Next Thread »
Thread Tools
Display Modes
Linear Mode Linear Mode

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT. The time now is 10:30 PM.

Contact Us - Archive - Top

Powered by vBulletin® Version 3.8.12 by vBS
Copyright ©2000 - 2025, vBulletin Solutions Inc.
X vBulletin 3.8.12 by vBS Debug Information
  • Page Generation 0.05527 seconds
  • Memory Usage 2,245KB
  • Queries Executed 13 (?)
More Information
Template Usage:
  • (1)SHOWTHREAD
  • (1)ad_footer_end
  • (1)ad_footer_start
  • (1)ad_header_end
  • (1)ad_header_logo
  • (1)ad_navbar_below
  • (1)ad_showthread_beforeqr
  • (1)ad_showthread_firstpost
  • (1)ad_showthread_firstpost_sig
  • (1)ad_showthread_firstpost_start
  • (4)bbcode_quote
  • (1)footer
  • (1)forumjump
  • (1)forumrules
  • (1)gobutton
  • (1)header
  • (1)headinclude
  • (1)navbar
  • (3)navbar_link
  • (120)option
  • (1)pagenav
  • (1)pagenav_curpage
  • (2)pagenav_pagelink
  • (9)post_thanks_box
  • (1)post_thanks_box_bit
  • (9)post_thanks_button
  • (1)post_thanks_javascript
  • (1)post_thanks_navbar_search
  • (1)post_thanks_postbit
  • (9)post_thanks_postbit_info
  • (9)postbit
  • (9)postbit_onlinestatus
  • (9)postbit_wrapper
  • (1)spacer_close
  • (1)spacer_open
  • (1)tagbit_wrapper 
Phrase Groups Available:
  • global
  • inlinemod
  • postbit
  • posting
  • reputationlevel
  • showthread
Included Files:
  • ./showthread.php
  • ./global.php
  • ./includes/init.php
  • ./includes/class_core.php
  • ./includes/config.php
  • ./includes/functions.php
  • ./includes/class_hook.php
  • ./includes/modsystem_functions.php
  • ./includes/functions_bigthree.php
  • ./includes/class_postbit.php
  • ./includes/class_bbcode.php
  • ./includes/functions_reputation.php
  • ./includes/functions_post_thanks.php 
Hooks Called:
  • init_startup
  • init_startup_session_setup_start
  • init_startup_session_setup_complete
  • cache_permissions
  • fetch_postinfo_query
  • fetch_postinfo
  • fetch_threadinfo_query
  • fetch_threadinfo
  • fetch_foruminfo
  • style_fetch
  • cache_templates
  • global_start
  • parse_templates
  • global_setup_complete
  • showthread_start
  • showthread_getinfo
  • forumjump
  • showthread_post_start
  • showthread_query_postids
  • showthread_query
  • bbcode_fetch_tags
  • bbcode_create
  • showthread_postbit_create
  • postbit_factory
  • postbit_display_start
  • post_thanks_function_post_thanks_off_start
  • post_thanks_function_post_thanks_off_end
  • post_thanks_function_fetch_thanks_start
  • fetch_musername
  • post_thanks_function_fetch_thanks_end
  • post_thanks_function_thanked_already_start
  • post_thanks_function_thanked_already_end
  • postbit_imicons
  • bbcode_parse_start
  • bbcode_parse_complete_precache
  • bbcode_parse_complete
  • postbit_display_complete
  • post_thanks_function_can_thank_this_post_start
  • post_thanks_function_fetch_thanks_bit_start
  • post_thanks_function_show_thanks_date_start
  • post_thanks_function_show_thanks_date_end
  • post_thanks_function_fetch_thanks_bit_end
  • post_thanks_function_fetch_post_thanks_template_start
  • post_thanks_function_fetch_post_thanks_template_end
  • pagenav_page
  • pagenav_complete
  • tag_fetchbit_complete
  • forumrules
  • navbits
  • navbits_complete
  • showthread_complete