Some idiot screwing with me.

My forum has been constantly turning on and off..... so now i receive this email

Alright f**ker..

Here's the deal. You don't want your site going down anymore? You're going to have to do 1 thing.

Give me access to your cPanel for the day. And tomorrow I'll remove my account that has all admin rights. Deal?

How I've been doing it.. hehe.. well, I have a hidden account on your database that has all admin rights. All I want to do is get in your cPanel to copy your database and I'll be on my way.

The way this works is.. you have a lot of users. You'll never find me in the 200,000something users you have. So.. therefore, you need me to give you the account I have so you can delete it. NOW.. replacing your database will not work. For I have a program on my desktop that gives me admin access to any vbulletin forum I want. You want your site safe? Well.. give me your cPanel and we'll call it even. You can change your cPanel password tomorrow.

He keeps turning it on and off how can i put an end to this!!

[volitian]

Originally Posted by indie2industry

gotcha

my apologys

Although Im sure we all agree with you on moral grounds alone, I guess the Boss has an obligation to "Inform you"

I've learnt alot from this thread, makes me think about security more to say the least

All The Guys @ Volitian.

[PET]

By the way. You know what would be cool? Just set up a "Custom PHP script" that will take the guy's IP. Just give the kid the link, and a face user/pass, end when he logins you will also get his IP, and you will also... scare him if you put some FBI page there

[Cars2007]

If you have photopost, photopost classifieds, or reviewpost, there is an exploit that was published a couple months ago. You should have an email from photopost.com telling you how to patch older versions. The exploit can be used to upload .php files to the web server by tricking photopost into thinking the file is legit.

[Shawn Yue]

Originally Posted by fordsho

My forum has been constantly turning on and off..... so now i receive this email

Alright f**ker..

Here's the deal. You don't want your site going down anymore? You're going to have to do 1 thing.

Give me access to your cPanel for the day. And tomorrow I'll remove my account that has all admin rights. Deal?

How I've been doing it.. hehe.. well, I have a hidden account on your database that has all admin rights. All I want to do is get in your cPanel to copy your database and I'll be on my way.

The way this works is.. you have a lot of users. You'll never find me in the 200,000something users you have. So.. therefore, you need me to give you the account I have so you can delete it. NOW.. replacing your database will not work. For I have a program on my desktop that gives me admin access to any vbulletin forum I want. You want your site safe? Well.. give me your cPanel and we'll call it even. You can change your cPanel password tomorrow.

He keeps turning it on and off how can i put an end to this!!

Please Do Not Use Bad Word In Here

And Contact Your Host For Help I Am Sure They Will Help You

[veenuisthebest]

Hi all,

First of all I'M a total newbie....joined a week back. Below is what I think about this discussion, its just my sweet little brainy thought over it..lol

i just went through the whole discussion, got to learn a lot..
But, I'd like to know something from the masters here !!

The person above "fordsho" describes his problem, he says that he has around 200000 members on his board. But did anyone noticed his Join Date and Post Counts ??

how can he ever have 200000 members in 3 months ??

If in any case, he's true then he must be using a nulled version of vBulletin since years that already contained some malicious program within itself that allowed the hacker to screw the board up OR he himself got lucky enough to get hands on the database of some big board (God knows how).

Please do reply to this and correct me if i'm going wrongg..

Thank You

[Yours]

Sounds like he gained access to an admin account and gave himself admin permissions. All you really have to do is go in and remove his admin rights, make every admin change their passwords and do scans on their computers. It would also be a good idea to change all of the site's passwords for cPanel, etc.

[indie2industry]

just getting back to this thread... I'm sorry.

I forgot to ask. Do you have any mods & add-ons you didn't get from here? he may have scripted himself access also.

Has he sent you an e-mail??? If so, he's TOAST!!! DON'T USE OUTLOOK!!
Go to www.mail2web.com

Login: yourname@yourdomain.com
password: your password

retrieve his message. In the bottom/left corner of the e-mail(s) it'll show his IP address.
FIRST, log into your server and block it from there.
THEN, go to your vbullletin admin cp, go to Banning Options, and ban the IP from there also. But DON'T BAN HIS E-MAIL!! If he contacts you again, you want to know from where so you can also block that IP.

This may also help.
https://vborg.vbsupport.ru/showthrea...ighlight=proxy

--------------- Added [DATE]1206062226[/DATE] at [TIME]1206062226[/TIME] ---------------

Originally Posted by PET

By the way. You know what would be cool? Just set up a "Custom PHP script" that will take the guy's IP. Just give the kid the link, and a face user/pass, end when he logins you will also get his IP, and you will also... scare him if you put some FBI page there

[Kimmi]

Originally Posted by veenuisthebest

Hi all,

First of all I'M a total newbie....joined a week back. Below is what I think about this discussion, its just my sweet little brainy thought over it..lol

i just went through the whole discussion, got to learn a lot..
But, I'd like to know something from the masters here !!

The person above "fordsho" describes his problem, he says that he has around 200000 members on his board. But did anyone noticed his Join Date and Post Counts ??

how can he ever have 200000 members in 3 months ??

If in any case, he's true then he must be using a nulled version of vBulletin since years that already contained some malicious program within itself that allowed the hacker to screw the board up OR he himself got lucky enough to get hands on the database of some big board (God knows how).

Please do reply to this and correct me if i'm going wrongg..

Thank You

He couldve had a different type of forum and switched to VB using the impex to transfer his other board.
and if had a nulled the staff would said something when he replied

[G0F0RBR0KE]

Originally Posted by Kimmi

He couldve had a different type of forum and switched to VB using the impex to transfer his other board.
and if had a nulled the staff would said something when he replied

On top of that. He wouldn't be able to post in the 'Big Board Discussions' since it's only for license uses.

[Deepdog009]

These links may assist U...> http://www.surprisechat.com/boards/v...d.php?tid=2458

http://www.emailabuse.org/

# Update your operating system with the latest patches.
# Keep your antivirus program up-to-date.
# Install a personal firewall.
# Periodically sweep for Trojan horses running on your PC.
# Use htaccess and allow only auth. ips access to control panel.
# Implement more security tracking software to view logs and vital areas of domain.

Good Luck