Can anybody explain where to look for in the logs ? How to analyse what has been done and how to see what is happening on the server.. ? Where to see these logs for hacking, for DDOS's or any other things what happens.. ?
You need to review the logs line for line. See if anything odd happens. Keep an eye on strange requests, especially by the same IP(s), especially in the photoplog directory. If you find a suspect IP run it trough vbulletin and see what comes up. You need to find out what services where exploited and if you can block these services, or at least make them more secure.
You should be able to access your logs trough your servers admin panel. Where in the admin panel depends upon which admin panel you have.
Quote:
Originally Posted by BlitzSports
I am running photoplog, or something like that. If I uninstall it will this stop the attacks?
This is hard to answer without knowing what exactly has happened. It is likely that the hacker gained access by finding an vulnerability in your photoplog directory. But this is far from certain. One thing you almost surely need to address is CMOD permissions of your directories. You will need to find out what is on your server that does not belong there. After you have found out what happened you could consider using a back up of your database and files and using that as your basis. It is possible that you have files and scripts on your forum, that will allow the hacker regain control.
01-25-2009, 10:36 PM
Threaded Mode