MyBB Community Forums

I went to my site and i found this
[attachment=16099]
I shut down my IIs 7 right away Now is there a way i can fix this

Find the source and look at the login logs from your cPanel or Contact your Web host and let them know, they'll see the last IP addresses loged in. Also I hope you have a backup of your MyBB... Could you also please provide us with a link please.

(2009-11-23, 02:42 AM)MadZula Man Wrote: [ -> ]Find the source and look at the login logs from your cPanel or Contact your Web host and let them know, they'll see the last IP addresses loged in. Also I hope you have a backup of your MyBB... Could you also please provide us with a link please.

Well i run the server on a home pc and the website address is http://www.howman.ca but i have the IIS 7 off

---

(2009-11-23, 02:46 AM)Howman Wrote: [ -> ]

(2009-11-23, 02:42 AM)MadZula Man Wrote: [ -> ]Find the source and look at the login logs from your cPanel or Contact your Web host and let them know, they'll see the last IP addresses loged in. Also I hope you have a backup of your MyBB... Could you also please provide us with a link please.

Well i run the server on a home pc and the website address is http://www.howman.ca but i have the IIS 7 off

I do got the ips from php my admin

Well than your Home PC wasn't secure enough.

(2009-11-23, 02:55 AM)Zomaian Wrote: [ -> ]Well than your Home PC wasn't secure enough.

Thanks i relizes that but i do have back up and i need to know how to find the time that the hack took place cause i want to make sure the data base back up was before hack just in case

Try the databae and see if it was hacked.

i guess thats what i get for not changing the admin dir but my site been up for a year and this if the first time in a year

---

yea it was hacked

---

DasHaxer user 1 which is admin and should be howmanadmin

---

So besides changing the admin dir is there any thing eles i can do to pervent this from happing again

To me it looks like they simply replaced an index file. It's a stupid so called hack that doesn't really do any damage. Without any records or anything we can't tell how it happened though.

(2009-11-23, 03:41 AM)NetSage Wrote: [ -> ]To me it looks like they simply replaced an index file. It's a stupid so called hack that doesn't really do any damage. Without any records or anything we can't tell how it happened though.

I just restored my data base and changed the Admin dir
Is there any thing eles i should do

Put a password and IP restriction on the /admin directory