Have some weird issues going on. Zombie threads? Help!

Started by blogger419, June 05, 2015, 01:36:23 PM

Previous topic - Next topic

Illori

Quote from: Steve on June 07, 2015, 08:58:36 AM
Have we determined moving posts is the cause of the OP's problem?

i dont think it is possible without someone looking at their forum. as the forum is an adult forum the link has not been posted. it may also take someone looking at the database to see what exactly is going on with the topics that have problems.

Steve

Then we're straying from the OP's question which is kind of the point I was trying to make if someone confirmed it. (thanks Illori) :)
DO NOT pm me for support!

Chas Large

Quote from: blogger419 on June 05, 2015, 06:22:59 PM
... Another issue point might be that one of the mods moved a bunch of threads around, which I've heard can mess up the post and thread counts.

Is it possible he means MODERATOR rather than ModIFICATION?
My Modifications :)  My Forum

Please DO NOT PM me with support requests. Post the problem in the appropriate Support Board so everyone can benefit from the advice given.

blogger419

I've performed a system restore to a few days prior to the problem showing up. Now things appear to be back to normal, however, it appears as though every one that was in the paid subscriptions group is no long a part of that group, despite it telling me that there a paid members. Any idea what could cause this?

Sir Osis of Liver

Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

blogger419

Getting a new error. Now members are disappearing:


messageThe database value you're trying to insert does not exist:
Function: MLAllApply Filter: Only show the errors from this file File: /home/admin/public_html/Sources/Memberlist.php
Line: 389

This is after having performed a server restore. Any idea what is going on?

Kindred

You obviously have some really badly installed or badly written mods...
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

margarett

Please attach that file, maybe it's possible to find the cause...
Se forem conduzir, não bebam. Se forem beber... CHAMEM-ME!!!! :D

QuoteOver 90% of all computer problems can be traced back to the interface between the keyboard and the chair

blogger419

Quote from: Kindred on June 16, 2015, 07:57:27 PM
You obviously have some really badly installed or badly written mods...

So how do I fix this? I don't want to loose my forum. Is there a way to simply start over and rebuild while keeping the database and attachments? I haven't installed anything new. I did move servers about two months ago. I am starting to wonder if the forum could be hacked as well. Only certain things seem to be disappearing.

blogger419


Kindred

Read the FAQ article on loading a fresh set of files
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

margarett

Actually I don't see anything wrong with that file (apart from messed indentation and line inserts but that's not a problem)

Can you give the complete error log message?
Se forem conduzir, não bebam. Se forem beber... CHAMEM-ME!!!! :D

QuoteOver 90% of all computer problems can be traced back to the interface between the keyboard and the chair

Sir Osis of Liver

Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters


margarett

Did you restore the complete VPS?
If that's the case, I can't understand why it happens... Your latest error (with search) suggests a missing field from the database, regarding the search query code. But if you restored everything, files and database should come together so they should tie together with the configuration they had when you created the image. It is possible that the error was already present, though.

About Paypal
Quotedespite it telling me that there a paid members
Most likely this is just the users primary group which came together with the database.

Since you own a VPS, you can do stuff more easily. I would suggest you to duplicate your database + files. In that copy, run repair_settings to point the database info + paths to it, and don't forget to choose to reset everyone to default theme.
Finally, load a fresh set of files in this copy according to the link Kindred gave you. Then see if the issues still exist.
Se forem conduzir, não bebam. Se forem beber... CHAMEM-ME!!!! :D

QuoteOver 90% of all computer problems can be traced back to the interface between the keyboard and the chair

blogger419

Quote from: margarett on June 19, 2015, 01:56:57 PM
Did you restore the complete VPS?
If that's the case, I can't understand why it happens... Your latest error (with search) suggests a missing field from the database, regarding the search query code. But if you restored everything, files and database should come together so they should tie together with the configuration they had when you created the image. It is possible that the error was already present, though.

About Paypal
Quotedespite it telling me that there a paid members
Most likely this is just the users primary group which came together with the database.

Since you own a VPS, you can do stuff more easily. I would suggest you to duplicate your database + files. In that copy, run repair_settings to point the database info + paths to it, and don't forget to choose to reset everyone to default theme.
Finally, load a fresh set of files in this copy according to the link Kindred gave you. Then see if the issues still exist.

I recently added a malware scanning service and it found the same malicious edits to: Sources/Subs-System.php, ssi_examples_.php, Themes/default/ManageSearch.template_.php, Sources/ManageAds.php

Any idea of how an attacker could have gotten to these files?  It looks like the script that they used is sort of a swiss army knife of attacks. I can post the code in an attachment if you'd like to see it.

Kindred

What same "malicious edits"? This is the first time I recall seeing anything about malicious edits..

As for how someone could get in...

1- server side
2- are you running any other scripts on the server?
3- what mods are running, after the complete reset? (You did do a complete reset, didn't you?)
4- are you hung the same password on any other sites?
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

Herman's Mixen

i suggest after your VPS restore.. close down your running services as FTP / MySQL / Apache /Nginx

then first go tighten up your system wide security...

chown and chmod your apache home directorie(s) to the correct settings for example your home directory is /home/domain/user/httpdocs chmod 750 and chown to apporiate user/group

start to maintain and logging stuff

start your services when al is good...

then you can start fixing your SMF related stuff...

good start for your linux tutorials see a website as for example howtoforge...
Met vriendelijke groet, The Burglar!

 House Mixes | Mixcloud | Any Intelligent fool can make things bigger, more complex, and more violent.
It takes a touch of genius - and a lot of courage - to move in the opposite direction. - Albert Einstein

Former Godfather of our dutch community ;)

blogger419

Quote from: Kindred on June 24, 2015, 06:58:46 PM
What same "malicious edits"? This is the first time I recall seeing anything about malicious edits..

As for how someone could get in...

1- server side
2- are you running any other scripts on the server?
3- what mods are running, after the complete reset? (You did do a complete reset, didn't you?)
4- are you hung the same password on any other sites?


Same as in it appears to be the same script in 4 different places. I just found them today. The VPS is dedicated to this site only, there shouldn't be any other scripts running. The same mods as listed above, I didn't remove any. By complete reset I mean that I re-imaged the sever with a early version. I have now changed all passwords related to the site. The DB and FTP passwords were diffrent though.

Advertisement: