ReadMe Before Posting / Frequently Asked Questions wrote: My board has been hacked, what do I do?
Please do the following before making any modifications to your board (this includes changing passwords, editing files, running the admin toolkit, etc.):
1) Save a copy of the files (simply create a local copy of the files on the server).
2) Save a copy of the database.
3) Save the server access logs for the time of the hack (they may be available in the 'logs' directory on the server, in your host's control panel or only by request directly from your host).
4) File a report in the incident tracker. Attach the items from steps 1-3 when you file the report or upload them to a secure location for the incident investigation team to download. Please do not start a new topic on the board, the proper place for incidents reports is the tracker.
I looked at the Admin Logs and there are no entries during the time I was gone. That is one of the reasons why I do not think the other Admin did it. The other reason is because I really don't think he knows how to disable the board. See, I take care of the forum on a routine basis. He is an Admin but he doesn't really do anything with the forum as long as I am around to handle it. If I am gone out of town, he will approve posts for new members, remove any post that is spam, stuff like that. But he doesn't get very involved with anything else on the forum.Kevin Clark wrote:Have you looked in the admin logs?
If the board is disabled or enabled through the admin panel it will show the user that did it, the time and the function will show as 'Altered board settings'.
Not really. There is a list of things that were done, and the list dates back to before I left town, but according to the log nothing was done while I was gone. Is it possible that something was done and then only that particular action was deleted from the Admin Log? The Admin Log does not show anything was done while I was away, but if someone was able to do something and then edit the Admin Log file, that would explain it. Is something like that even possible?*Daniel wrote:Is there anything there to show that the admin log have been cleared?
Of course it's possible. However, the phpBB log isn't kept in a log file; it's kept in the log table in the phpBB database. If your other admin has access to your server, he could use phpMyAdmin to delete records from that table.Big-Jim wrote:The Admin Log does not show anything was done while I was away, but if someone was able to do something and then edit the Admin Log file, that would explain it. Is something like that even possible?