I can't stop this hacker ??

GiffHost · Post by **GiffHost** » Fri Mar 09, 2012 7:59 pm

Hello,

Someone with a ip of "217.114.61.34" keeps hacking my board. He goes in the ADM and changes stuff. He shows as a random admin account, mine has been used so i know it is not my friend. He changes alot of stuff, then CLEARS the admin log so its really hard to know what he/she/IT done.

Any advice ? I am sick of banned users, mass emails sent, clearing logs, deleting posts.

Thanks

Post by **KevC** » Fri Mar 09, 2012 8:02 pm

That IP belongs to Lancaster University.

What exactly are they doing? If the logs are cleared how do you know they're in there? What are you seeing?

GiffHost · Post by **GiffHost** » Fri Mar 09, 2012 8:06 pm

Kevin Clark wrote:That IP belongs to Lancaster University.

What exactly are they doing? If the logs are cleared how do you know they're in there? What are you seeing?

DAY 1: Sent a mass email (Totaly spam) , Deleted 4 users, Changed the admin users passwords. Cleared logs.

Day 2: Sent mass email (It was like "This board is closing please move to this board xxx.xxx) , Changed admin passwords. Cleared Logs.

Also once i was in the ACP while that IP was in, and seen what he changed then he clears log.

Thanks

Post by **KevC** » Fri Mar 09, 2012 8:35 pm

Go to whois.sc, enter that IP and report it to their abuse email address.

Tell all your admins to change their passwords.

Check you haven't accidentally given the registered users group some admin permissions.

GiffHost · Post by **GiffHost** » Fri Mar 09, 2012 8:40 pm

Thanks. That ip has never been on the forum as a user. I made all admins change password. But still happebs

Post by **Brf** » Fri Mar 09, 2012 8:44 pm

They would have to be a user.
An unregistered guest would not be able to use the Admin control panel.

CaNNon_ · Post by **CaNNon_** » Fri Mar 09, 2012 9:03 pm

I'd check your .htaccess files just to make sure they are in place and functioning.

image45 · Post by **image45** » Thu Mar 15, 2012 3:01 pm

Do you have a wordpress blog or other such on the same domain name path that has allowed an exploit to be used?

There are a few hacker scripts that can be uploaded onto the servers file system, allowing all sort of anonymous actions to be used.

Pony99CA · Post by **Pony99CA** » Fri Mar 16, 2012 2:58 am

Kevin Clark wrote:If the logs are cleared how do you know they're in there?

When you clear the logs, a Cleared Log entry is made in the log. You'll always have at least one of those no matter what else you clear (unless the user has database access, of course).

Steve

advertisements