(read first) If your site hacked

Site Admin Joined: Aug 17, 2003 Posts: 12397

Did you clear your authors table and make a new God account? Any error messages? Please enable error reporting and check your error logs

Nuke Cadet Joined: Feb 20, 2006 Posts: 4

I did not clear the authors table, and it won't let me make the God Account, as the security graphic won't appear. I just disbled that and got it to work, only to find myself stil in the endless loop of 'create the superuser' 'login' 'create the superuser'

I would love to check for and turn on error checking, but as I inherited the site, and am not too php savy...I am unsure how.

Dave

Posted: Tue Feb 21, 2006 12:12 am

Add this code to the bottom of your db parameters section of config.php

Code:

$display_errors = 1;

Nuke Cadet Joined: Feb 20, 2006 Posts: 4

Quote:

<?php
require_once("mainfile.php");
if (!isset($prefix)) die('config.php not loaded properly.');
if (!isset($db)) die('database layer not loaded properly.');

$sql = "DELETE FROM " . $prefix . "_authors";
$result = $db->sql_query($sql);
if ($result) {
echo "All administrator accounts has been removed.<br/>";
echo "Now run admin.php to create new admin account.";
} else {
echo "Unable to access to database.";
}
?>

This was the script I ran to clear the Admins

I added the "errors" line in config, now what?

Nuke Cadet Joined: Mar 28, 2006 Posts: 3

greeting my fellow seniors ... I'm here to request a help on how to rectifiy my phpnuke site which has been hacked. The hackers simply re route my site to his ... the address of my website is http://www.mymatrixclub.net a website about Hyundai Matrix MPV ... please help me Confused

THANKS

Posted: Tue Mar 28, 2006 11:30 pm

asoffian wrote:

greeting my fellow seniors ... I'm here to request a help on how to rectifiy my phpnuke site which has been hacked. The hackers simply re route my site to his ... the address of my website is http://www.mymatrixclub.net a website about Hyundai Matrix MPV ... please help me Confused

THANKS

Go to your Admin Control Panel and then to Config....remove the redirect codes from your footer message

Also, you need to add some "define" lines to your blocks>siteinfoblockfoldername>languages>lang-english.php file. For your site info block.

(siteinfoblockfoldername will be whatever it is named inside the blocks directory)

Code:

_BHITS = Hits
_PASSWORDLOST = Lost Password

Those two need to be defined

Posted: Tue Mar 28, 2006 11:35 pm

Quote:

This was the script I ran to clear the Admins

I added the "errors" line in config, now what?

Try to make a super admin (god), and note any errors. Post them here.

Nuke Cadet Joined: Mar 28, 2006 Posts: 3

Go to your Admin Control Panel and then to Config....remove the redirect codes from your footer message

Mr. BS ... how to go to admin control panel because if I type ~/admin.php the thing reroute to the hackers website as well Embarassed

Site Admin Joined: Aug 17, 2003 Posts: 12397

You will need to use phpMyAdmin to access your database and delete those lines from your config table

Nuke Cadet Joined: Mar 28, 2006 Posts: 3

ok cheers now get in hold back .... excellent ... any suggestion on how to avoid site from being hacked?

Site Admin Joined: Aug 17, 2003 Posts: 12397

Patched files, Sentinel...

http://www.nukecops.com/modules.php?name=Forums&file=modules&name=Forums&file=viewtopic&t=32206#139865

Private Joined: Jan 03, 2006 Posts: 37

Is ANY of this supposed to make sense to any other than the most l33t of readers? I know it says to read it first, and believe me, 3-4 times I did just that.

Bigger question is how on earth do these hackers get to post links to their sites without being arrested or just beaten to death?

Site Admin Joined: Aug 17, 2003 Posts: 12397

Most of them are just kids from foreign countries. Very little you can do but report them to their ISP.

Really you should have the basic understanding of how to use phpMyAdmin, that should solve many issues right of the bat.

Private Joined: Jan 03, 2006 Posts: 37

Evaders99 wrote:

Most of them are just kids from foreign countries. Very little you can do but report them to their ISP.

WHOIS.SC says this one's in Illinois, but either way, is there any law enforcement agency they can be reported to? Hell, their hosting company got a link on my front page just the same.

Crazy business, this new vandalism.

Nuke Cadet Joined: Mar 24, 2006 Posts: 3

Sorry for the Nub question:

http://www.paragonsofjustice.org/

My site was hacked, about 2 weeks, ago, I reset the admin's, but all of the admin stuff if working, except that when I go into the Forums, from the admin panel, it just goes blank.

I have restored the database, of users, but there is over 4500 forums posts, so I really dont want that to be dumped, or rebuilt.

I have reloaded the forums, files from the ZIP of 7.8 and still no luck, is there somewhere that they would have changed it in the sql side, or something that I missed.

I have been looking for how to fix this since, the site attack, any help would be awsome.

PHPnuke 7.8 BBtoNuke 2.0.17

Thanks.