Members lost Post Count - Timezone changed - hacked?

Technical Details

Forum version : #phpBB2
Position : Administrator
Concerned browser(s) : Mozilla Firefox
Who the problem concerns : A few members
When the problem appeared : Was informed today about it.
Forum link : http://novel-lust-cafe.forumotion.com/

Description of problem

Hi! I'm Gabriella the acting Admin of the Novel Lust Cafe.
Today I was informed that some members have lost post counts. None of the other Admins (incl. the Forum Founder) and Mods have deleted any messages.

The founder and I discussed a new member with a strange name over the weekend which she wanted to ban, because we thought it could be a hacker. (Btw..she's now deleting the person.)

To make things really strange none of us activated this member. And as of today, some of our members complained because they had lost post counts and we're not talking 20 or 50 posts...some of them have lost 12000 posts...!

When I logged on the the Admin panel, I also saw that the forum timezone was changed to Ashgabat.

What can I do? Or what can the founder do? Do you think we were hacked?

Also, daily backup was activated. How can I implement the backup? Will that restore the post count? And is there a way to secure the forum?

Thanks for your help!

Try this:  AP > General > Forum > Configuration
Scroll to the bottom and resyn the forum.

SLGray wrote:Try this:  AP > General > Forum > Configuration
Scroll to the bottom and resyn the forum.

Do you mean this:
Resynchronize your forum statistics : Check to resynchronize

Yes

*Gabriella* wrote:

SLGray wrote:Try this:  AP > General > Forum > Configuration
Scroll to the bottom and resyn the forum.

Do you mean this:
Resynchronize your forum statistics : Check to resynchronize

The other Admin did it and nothing happened. We can't see any difference.
Any other ideas?

Hello,

You could try asking your forum founder to sign into the forum utilities and do a members and posts restore. This should restore the deleted messages.

Also bare in mind any deleted members or banned members will return as well once you do this so you will need to re delete them/re ban them.

Also any new messages and members after the restore date will be removed.  You will have to do another restore date closer to the present date.

Hello @*Gabriella*

This is very weird. I really don't know how this could happen since our forums are 100% secure. Maybe this user who says is a hacker guessed your password or your other admin's password. In which case, you could see a log of the actions taken by the administrators and moderators as well as the IP address of whoever did those changes in here:
ACP -> General -> Security

In order to restore those messages and weird things happening in your forum, I recommend you to do a Forum Back-Up through the Forumotion utilities. In order to know how this work please read the following post:
https://help.forumotion.com/t9692-the-utilities-backup-and-restore#49986

You have several types of back-ups. You have to chose the one that fits better with what you need. In the link I have just gave you everything is explained clearly However, if you still have doubts you can post them here

Best regards.

Thanks everyone!
I'm going to email the forum founder and tell her what you've recommended. I'll let you know what we did and how it worked.

And mpelmmc thanks for the link...

Have you checked the security logs?

SLGray wrote:Have you checked the security logs?

Yes. It says I updated the user.
Well, I checked the user...because the name was strange, but I never activated him. I remember when I went to check out the name the user was already activated. Also the logs don't show who activated him.

Also the founder had trouble logging on to the forum and had the other Admin change her password, some time after the new member appeared.

Do you guys have it set to user activation? Meaning where new users recieve an email with an activation link?

brandon_g wrote:Do you guys have it set to user activation? Meaning where new users recieve an email with an activation link?

The Admins have to activate a new member.

I mean see if someone deleted posts.

*Gabriella* wrote:

brandon_g wrote:Do you guys have it set to user activation? Meaning where new users recieve an email with an activation link?

The Admins have to activate a new member.

Is Topic'It activated?  If yes, it could be that they are registering with it.  You have to set it to follow the forum's register setup.

SLGray wrote:

*Gabriella* wrote:

brandon_g wrote:Do you guys have it set to user activation? Meaning where new users recieve an email with an activation link?

The Admins have to activate a new member.

Is Topic'It activated?  If yes, it could be that they are registering with it.  You have to set it to follow the forum's register setup.

Okay...where can I see if Topic'It is activated?

AP > Modules > Topic"it

Thanks SLGray
I checked it...and that door was wide open. Oops. It's closed now.

So, may we consider this topic as solved?

mpelmmc wrote:So, may we consider this topic as solved?

Nope. We're sill trying to restore the posts that were lost.

Have you done the back up?

mpelmmc wrote:Have you done the back up?

Still trying to do it. The founder is searching for the founder password...could be that we'll need to reset it. I already told her she would likely have to come here to verify she needs a new one.
When it rains, it pours.

The founder will have to come and ask for help.

Give your founder this link: https://help.forumotion.com/t127211-password-problems-or-lost-your-founder-s-password . Ask him/her to send one of the listed staff members a pm with the email address they used to create the forum.

Thanks for the info.
Can one of you please contact me via PM. We have a very serious problem.

Hi @*Gabriella*

If the founder admin wants to recover the password of the forum he/she can feel free to contact one of the members listed in the link we gave you. Otherwise, he/she can open up a topic in the public section as no support is provided by PM excepting lost password issues

Best regards

mpelmmc wrote:Hi @*Gabriella*

If the founder admin wants to recover the password of the forum he/she can feel free to contact one of the members listed in the link we gave you. Otherwise, he/she can open up a topic in the public section as no support is provided by PM excepting lost password issues

Best regards

Okay...I really would have liked to not discuss this in an open forum (it's a bit embarrassing)...but here goes.
Our forum was set up by an Admin who was very computer savvy. She entered the current "founder" as the founder...unfortunately this computer savvy Lady passed away some years ago due to cancer and it seems like the she didn't provide the much needed password. Also, we're (I'm a new Admin) not sure which is the founder address you'll need to provide the new password.
We're currently contacting one other member (who acted as an Admin at the time the forum was set up) if she has any other information.

I hope this wasn't too confusing. Sorry. I'm really trying to understand and relate this myself.

Hi @*Gabriella*

Actually, there is a way of recovering the founder's account if it's been absent for more than 6 months and 1 day Please read the following topic:
https://help.forumotion.com/t81878-recovery-or-change-founder-of-an-account#528888

You can send me the information needed if you wish

Best regards.

mpelmmc wrote:Hi @*Gabriella*

Actually, there is a way of recovering the founder's account if it's been absent for more than 6 months and 1 day Please read the following topic:
https://help.forumotion.com/t81878-recovery-or-change-founder-of-an-account#528888

You can send me the information needed if you wish

Best regards.

I just read it. As I see it this doesn't apply to us.

The person entered as the founder is our current "founder"...she just didn't set up the forum (another person did that) and she doesn't have any information she can provide. We can try the email address set as Admin email, but that's it...the problem is she was always entered as the founder and has acted as the founder...but the set up of the forum was done by the member that passed away.

Are you sure? I can see that the founder account hasn't connected since 2013

The founder account is the profile /u1 in your forum