Forum might be hacked. Please read & help!

This is an archive of the phpBB 2.0.x support forum. Support for phpBB2 has now ended.
Forum rules
Following phpBB2's EoL, this forum is now archived for reference purposes only.
Please see the following announcement for more information: viewtopic.php?f=14&t=1385785
Locked
M Macaroni
Registered User
Posts: 9
Joined: Thu Jul 03, 2008 11:15 am

Forum might be hacked. Please read & help!

Post by M Macaroni »

Hi everyone,

I and a couple of friends run a website and forum and from this morning we can't get into the forum using out regular url. http://forum.ourdomainname.com .
It gets redirected to an advertising site.

We can still get into the forum using the url like this http://ourdomainname/forum. But then we can't get into administration panel. it gives a 404 page of our server host.

Everything in cpanel seems to be fine.

We think we might have been hacked but don't know how to solve it.

We're running 2.0 but not the last update because we were still figuring out if that would work with the MODs we've installed. (We are quite new to running a website)

Any help would be much appreciated.
Let me know if you need more info, I've tried to be as clear as possible.

Thank,
MM
User avatar
RMcGirr83
Former Team Member
Posts: 21913
Joined: Wed Jun 22, 2005 4:33 pm
Location: Your display
Name: Rich McGirr

Re: Forum might be hacked. Please read & help!

Post by RMcGirr83 »

If you post a link to your forum, that would probably help a lot.
Former Modifications/Extensions Team Member | My extensions | github | All requests for support via PM will be ignored
Appreciate the extensions/mods/support then buy me a beerImage
User avatar
stevemaury
Support Team Member
Support Team Member
Posts: 51906
Joined: Thu Nov 02, 2006 12:21 am
Location: The U.P.
Name: Steve
Contact:

Re: Forum might be hacked. Please read & help!

Post by stevemaury »

404 means files aren't there. It will be difficult to help you unless you give the real URL of your board.
For REALLY good and VERY inexpensive hosting CLICK HERE

I can stop all your spam. I can upgrade or update your Board. PM or email me. (Paid support)
User avatar
Brf
Support Team Member
Support Team Member
Posts: 52309
Joined: Tue May 10, 2005 7:47 pm
Location: {postrow.POSTER_FROM}
Contact:

Re: Forum might be hacked. Please read & help!

Post by Brf »

That 404 is because the cookie domain is forum.website and script path is "/", so redirects starting from /forum/ go to the wrong place.

Probably, someone has placed a index.html file in your forum's directory, or an htaccess redirect somewhere.
M Macaroni
Registered User
Posts: 9
Joined: Thu Jul 03, 2008 11:15 am

Re: Forum might be hacked. Please read & help!

Post by M Macaroni »

the link to the forum is

http://forum.benellisfansite.com

or the one that still works

http://benellisfansite.com/forum

Probably, someone has placed a index.html file in your forum's directory, or an htaccess redirect somewhere.

Do you mean in cpanel? What do I do about it?
M Macaroni
Registered User
Posts: 9
Joined: Thu Jul 03, 2008 11:15 am

Re: Forum might be hacked. Please read & help!

Post by M Macaroni »

I've found a file called .htacces in my forum directory.

If I click on the url of it http://www.benellisfansite.com/forum/.htaccess I get a 404 page.

Could that be it? Or is this normal. And yes the filename start with a dot.
User avatar
Brf
Support Team Member
Support Team Member
Posts: 52309
Joined: Tue May 10, 2005 7:47 pm
Location: {postrow.POSTER_FROM}
Contact:

Re: Forum might be hacked. Please read & help!

Post by Brf »

YOu cannot browse to an htaccess file.
Use your cpanel file explorer and see what is in it.
momentum
Registered User
Posts: 1505
Joined: Thu Sep 20, 2007 4:07 am
Location: Melbourne, Australia

Re: Forum might be hacked. Please read & help!

Post by momentum »

The .htaccess is a file for Apache (the web server) to read only. It won't allow you to read it from outside. It's usually used to limit access to the directory it's stored in.

As for your sub-domain, (forum.benellisfansite.com) check in your cPanel under subdomains and see where the sub-domain redirects. It should be setup to point to http://benellisfansite.com/forum

Craig.
QOTY: phpBB is free, good hosting is not. - robert (Lumpy Burgertushie)
M Macaroni
Registered User
Posts: 9
Joined: Thu Jul 03, 2008 11:15 am

Re: Forum might be hacked. Please read & help!

Post by M Macaroni »

momentum wrote:The .htaccess is a file for Apache (the web server) to read only. It won't allow you to read it from outside. It's usually used to limit access to the directory it's stored in.

As for your sub-domain, (forum.benellisfansite.com) check in your cPanel under subdomains and see where the sub-domain redirects. It should be setup to point to http://benellisfansite.com/forum

Craig.
Do you mean subdomains stats?

That doesn't say http://benellisfansite.com/forum or forum.benellisfansite.com :(
M Macaroni
Registered User
Posts: 9
Joined: Thu Jul 03, 2008 11:15 am

Re: Forum might be hacked. Please read & help!

Post by M Macaroni »

the htacces file says just

DirectoryIndex index.php
momentum
Registered User
Posts: 1505
Joined: Thu Sep 20, 2007 4:07 am
Location: Melbourne, Australia

Re: Forum might be hacked. Please read & help!

Post by momentum »

Forget the .htaccess file. It's fine and doing it's job.

Go back to your cPanel and open the Subdomains section. See what settings are in there.

If you can't find anything relating to subdomains then that's probably why the forum.benellisfansite.com URL no longer works. forum.benellisfansite.com is a sub-domain so without anything to define it, it simply doesn't exist.

Craig.
QOTY: phpBB is free, good hosting is not. - robert (Lumpy Burgertushie)
M Macaroni
Registered User
Posts: 9
Joined: Thu Jul 03, 2008 11:15 am

Re: Forum might be hacked. Please read & help!

Post by M Macaroni »

thank you for all your help, problem is sorted for now. Yes for some reason the forum no longer appeared as a subdomain in cpanel, adding it back has sorted it, at least temporarily.

I can't find any obvious redirects in the files, although 2 files look "odd" - extension.inc and common.php but as the version is so old I'm not sure how I could restore original versions and would prefer to avoid a full backup restore and will probably upgrade to phpBB3
User avatar
ric323
Former Team Member
Posts: 22910
Joined: Tue Feb 06, 2007 12:33 am
Location: Melbourne, Australia
Name: Ric
Contact:

Re: Forum might be hacked. Please read & help!

Post by ric323 »

M Macaroni wrote:I can't find any obvious redirects in the files, although 2 files look "odd" - extension.inc and common.php but as the version is so old I'm not sure how I could restore original versions and would prefer to avoid a full backup restore and will probably upgrade to phpBB3
What do you mean "odd". They are standard phpBB files.
The Knowledge Base contains solutions to many common problems!
How to fix "Doesn't have a default value" and "Incorrect string value: xxx for column 'post_text' " errors.
How to do a clean re-install of the latest phpBB3 version.
Problems with permissions? Read phpBB3 Permissions
Locked

Return to “2.0.x Support Forum”