hackers suck

dont they

[mack]

i have never had much to say about hackers....until now. my entire database has just been erased (for my web directory)so i now have a load of empty categories and what have they gained from it... nothing!
they wherent even that smart theu have left logs in my server logs.. any suggestions what to do with them???

[Froggyman]

I wouldn't say post the logs here because Brett may not like it but if you could sticky mail me the logs I would appreciate it.

Also what operating system is your server running on?

[mack]

the server is running unix...
directory was running links 2 gossamar threads. the host was f2s.

i am trying to find the location of a back up . The sxcript is supposed to produce a back up after every build. but then again that may be lost also due to being located om the server.

[Froggyman]

Also, I'm just interested in the logged IP's.

[mack]

el01-24-163-254-233.ce.mediaone.net

[rcjordan]

mack, unless you disabled it on purpose, links2 makes a backup (check the admin/backup directory). However, if you have two files that you may have downloaded, categories.db and links.db you can recover at least up to the point the archive copies were made. These files are in admin/data.

[Froggyman]

mack, I have sticky mailed you some info on that IP.

Contact [e-mail] and let them know what happened. They will take action on that individual. I've worked with them before in a situation like this and they ended up dropping the subscriber. They will probably want to see your log files as well.

[mack]

hi again.
ok i have been checking about on the server to see what is left. and thanks rcjordan i have a list of files on the cgi-bin/admin/backup that i may be able to use. there is a backup file from 15 june so i may be able to make use of this.

[rcjordan]

OK, that's good news. I suggest you get in touch with the regulars over at the Gossamer Threads forum. I've never rebuilt from a backup.

Note: You may need to reset your categoryid.txt and linksid.txt files to the proper counts. Ask around over at GT, someone there will know whether that's automatically done w/ the backup.

[mack]

yeaaaaaaa.
i got it back on....
simply save the most recent backup to your computer and remove the date on the file name call it link.db and replace the existing link.db file i went to admin clicked on build and woopie all is well again.

thanks for the great help there.:)

[rcjordan]

Awright! Excellent!

OK, to keep a local copy of L2, all you need are the 2 .db (they are text, btw) files mentioned above, and your (modified) scripts and templates. I suggest FTP-ing in and pulling down a copy to get completely free of the server backup and potential hacker damage.

[mack]

yea i agree.
i am goint to backup to local system once a week from now on. at keast if things go tops up again i will know exactly what to do. i took your advice and headed out to gossamer threads (the most intimidating forum on the web) :) and Eliot told me exactly what to do. For once he didnt say that i was posting in the wrong forum or send me to search the resources centre.:)

cheers for the advice.

[rcjordan]

>Eliot

Eliot still there? Man, he must have a post tally in the millions by now. He knows his Links.

I'm glad this worked out for you. Oh yeah, remember to change your password in the .htaccess in admin. The hackers may have that, too.

[startup]

Mack, did you password protect the admin page, or did they find another way in?

[mack]

the admin page is htaccess protected to youre guess is as good as mine as to how they got in... yea eliot is still there... he owns gossamar (doesnt he)???

[startup]

I am running the same script, if you find out how they got in please let me know.

[rcjordan]

>youre guess is as good as mine as to how they got in...
>
Well, you or your host need to find and shut down the way they got in, that's for sure.

>he owns gossamar (doesnt he)???
>
Not really sure, but I think Alex Krohn owns GT.

[mack]

hi there you are right alex is the top man at gt.
i went over there now and found out.

as for eliot.. i just assumed that he must have worked for them because his name is on at least one post for every thread.

and startup if i find out how they got in i will post it here and on gt.