smf database deleted

#1 (**permalink**) 06-13-2011, 01:18 PM

Hi
I have an SMF forum. REcently I've had scores of new members joining
with no posts.
Today a new member joined at 13:40 and at 14:20 I received an error
message 'database doesn't exist'
Going to my hoster I see that in fact the database had dissapeared
completely. Luckily I had a backup.
Looking at my site by ftp I see several php files were last modified at
13:40 and the settings at 14:20. I can see no changes to the code.

I've changed my password for the database. Any other precautions to take?

--
Audio Tour Guide d day Normandy. Self Guiding.
http://normandy-tour-guide.cpmac.com.audio-guide.php3
Driver guide Normandy

#2 (**permalink**) 06-13-2011, 02:01 PM

MCGARRY wrote:

>Hi
>I have an SMF forum. REcently I've had scores of new members joining
>with no posts.
>Today a new member joined at 13:40 and at 14:20 I received an error
>message 'database doesn't exist'
>Going to my hoster I see that in fact the database had dissapeared
>completely. Luckily I had a backup.
>Looking at my site by ftp I see several php files were last modified at
>13:40 and the settings at 14:20. I can see no changes to the code.
>
>I've changed my password for the database. Any other precautions to take?

Does it have an install.php still in the root of the forum s/w? That is
supposed to be deleted manually after installation. Also, you should
have access to all the logs to see where the attack came from. If it's
from China or some other country that does not need to see the site, you
can Geo-block whole regions.

Did you change the UN/PW on the management portal as well as the SQL
database?

#3 (**permalink**) 06-13-2011, 04:13 PM

>
> Did you change the UN/PW on the management portal as well as the SQL
> database?
>

I've changed both. My logs haven't been updated since 2009. I'm
questioning my hoster about that.

--
Audio Tour Guide d day Normandy. Self Guiding.
http://normandy-tour-guide.cpmac.com.audio-guide.php3
Driver guide Normandy

#4 (**permalink**) 06-13-2011, 04:52 PM

From: "MCGARRY" <webmaster4@cpmac.com>

>
>> Did you change the UN/PW on the management portal as well as the SQL
>> database?
>>
> I've changed both. My logs haven't been updated since 2009. I'm questioning my hoster
> about that.
>

Make sure *all* software is up-to-date as well as perform an IA scan on the system.

--
Dave
Multi-AV Scanning Tool - http://www.pctipp.ch/downloads/dl/35905.asp