i think i have been hacked! help me ban these chumps

Hangin' Around Joined: Dec 08, 2008 Posts: 30

Hi guys

yea i think my ravennuke site has been hacked reasons for this are when im in ACP and click on nukeSentine i get fowarded to this website [ Only registered users can see links on this board! Get registered or login! ] and also when i click on my acc i get put the same website [ Only registered users can see links on this board! Get registered or login! ] Sad

i think the hacker has changed a file or something to foward to there website werid, any way if anyone knows how to fix it that would be great

thanks
wind Very Happy

Posted: Sat Feb 28, 2009 7:23 pm

Probably so, we need to take a look at your site. Most likely they added things into your database

Posted: Sat Feb 28, 2009 7:46 pm

what version are you using and also i hope you make regular back-ups of your site...

Involved Joined: Apr 06, 2008 Posts: 484

just to make sure are you definately running RN 2.30.01 and how long.

Posted: Mon Mar 02, 2009 2:41 am

evaders99 wrote:

Probably so, we need to take a look at your site. Most likely they added things into your database

sure would you recommend i pm you the link or just post here?

Quote:

what version are you using and also i hope you make regular back-ups of your site...

um version v2.20.01 i think and no i haven't been making back ups lately witch is foolish i know Sad

Quote:

just to make sure are you definately running RN 2.30.01 and how long.

uh v 2.20.01 i think sorry if its in wrong thread and i have been using since December

thanks
wind

Posted: Mon Mar 02, 2009 7:41 pm

PM me please

You really do need to upgrade, there are security issues with older versions before 2.30.01

Posted: Thu Mar 05, 2009 12:03 am

Wow okay.. this seems to be a host issue. Your host seems to be replacing some blocked code on the server level, through Apache, not in PHP or MySQL.

Somewhere in the line

Code:




in admin\modules\nukesentinel\functions.php





  echo '<tr><td>'.help_img(_AB_HELP_065).'</td><td><a href="'.$admin_file.'.php?op=ABBlockedIPMenu">'._AB_BLOCKEDIPMENU.'</a></td></tr>'."\n";

[ Only registered users can see links on this board! Get registered or login! ]

I've never seen this kind of activity done by a host. It's not logical - its just confusing why they would do such a thing

Posted: Thu Mar 05, 2009 12:18 am

I can confirm that, I just checked one of my test sites I much around with, and it is the same

Posted: Thu Mar 05, 2009 3:40 am

ah thanks mate free host are not always what the appear

thanks evaders99 for doing the test 4 me Smile

your a good guy

Posted: Thu Mar 05, 2009 6:47 am

Unfortunately quite often you get what you pay for. Sad

Of course I am sure Raven would be willing to help for a small fee. Wink