1
marcan
Big problem : could I've been hacked ?
  • 2004/4/23 14:30

  • marcan

  • Just can't stay away

  • Posts: 824

  • Since: 2003/10/8


Hi !

This happened monday morning and today (friday) morning. Both time, it seemed to be the same thing. What I really need to find is what is causing that !

Here is the decription of what happened. It seems like changes were made in the database. Everything is working find and then :

- The default theme was 'mytheme' and it changed to 'default'
- The default template was 'mytemplate' and it changed to 'default'
- All groups lost ALL their System Admin rights, Module Admin rights and Module Access rights
- The Recent topic block of the forum was granted access by all groups.

All of these happen monday. I corrected all of them. This morning, same thing happened again.

I noticed something weird after the bug of monday : in the Preferences Main »» General Settings, the field Selectable theme and Default template set were displayed twice, and today, they are displayed 3 times :

Resized Image

Did someone ever encountered this problem? Would it be possible that the site was hacked ? Could someone help me resolving this issue ? I know you will probably need more informations but I don't know wahat exactly to give you.

Thanks for your help !

2
tl
Re: Big probleme : could I've been hacked ?
  • 2004/4/23 14:50

  • tl

  • Friend of XOOPS

  • Posts: 999

  • Since: 2002/6/23


Hacked? probably not. You would have to check your logs to make sure.

Quote:
I noticed something weird after the bug of monday : in the Preferences Main »» General Settings, the field Selectable theme and Default template set were displayed twice, and today, they are displayed 3 times :


My guess is that a recently installed module has messed up your config. I would remove the module and update the system module after that. Oh, please back up your current settings before you attempt to repair it, so you would have a copy to fall back to.


3
marcan
Re: Big problem : could I've been hacked ?
  • 2004/4/23 14:55

  • marcan

  • Just can't stay away

  • Posts: 824

  • Since: 2003/10/8


Thanks for your help tl.

However, I can't recall installing a module recently. I don't know exactly when it happend today but when it dud happen monday, it was perfectly working at 7:30, and 15 minutes later, it happened. I did not install any module in that 15 minutes.

As someone suggested to me by email, could this be related to corrupt tables?

And why did it happened twice? This probably mean it will happen again...

Thanks for any help !

4
tl
Re: Big problem : could I've been hacked ?
  • 2004/4/23 15:02

  • tl

  • Friend of XOOPS

  • Posts: 999

  • Since: 2002/6/23


Check the config table to see if you have duplicated entries for themes and templates and remove them manually.

5
marcan
Re: Big problem : could I've been hacked ?
  • 2004/4/23 15:23

  • marcan

  • Just can't stay away

  • Posts: 824

  • Since: 2003/10/8


Thanks again tl !

OK, I checked the config table and I found some interesting things !

I've got a lot of things that are tripled !
- theme_set_allowed
- sslloginlink
- mailmethod
- fromname
- from
- sendmailpath

And maybe others...

What could have cause this and is this related to the problems I have regarding the default theme and template set that have been changed? And all the permissions that I lost?

Thanks for your help !





6
marcan
Re: Big problem : could I've been hacked ?
  • 2004/4/23 18:46

  • marcan

  • Just can't stay away

  • Posts: 824

  • Since: 2003/10/8


Allow me to ask help again... Anyonw have an idea of why this happens ?

Thanks fellow Xoopsers

7
JackJ
Re: Big problem : could I've been hacked ?
  • 2004/4/23 22:30

  • JackJ

  • Community Support Member

  • Posts: 747

  • Since: 2003/8/31


Someone had a similar problem to yours. see this thread here:

https://xoops.org/modules/newbb/viewtopic.php?topic_id=12452&forum=7#forumpost49892

I dont know if the individual solved the problem, but you could perhaps PM him.

I have found in the past just going to system admin--> groups-->webmasters group, and clicking "update" has solved any previous admin display duplication problems. But may not help here.


8
marcan
Re: Big problem : could I've been hacked ?
  • 2004/4/24 17:51

  • marcan

  • Just can't stay away

  • Posts: 824

  • Since: 2003/10/8


Thank you Jack, however, it dio not solve my problem


Does anyone have another suggestion ! I need to find what caused all this. Each time I go to this site, I' afraid it will have the bugs all over again. The big problem is when it happens, all the access right for all modules are deleted so no one can accesssed nothing....

Thanks for your help !

Login

Who's Online

276 user(s) are online (57 user(s) are browsing Support Forums)


Members: 0


Guests: 276


more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: Aug 31
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits