Members lost Post Count - Timezone changed - hacked?

First topic message reminder :

Technical Details

Forum version : #phpBB2
Position : Administrator
Concerned browser(s) : Mozilla Firefox
Who the problem concerns : A few members
When the problem appeared : Was informed today about it.
Forum link : http://novel-lust-cafe.forumotion.com/

Description of problem

Hi! I'm Gabriella the acting Admin of the Novel Lust Cafe.
Today I was informed that some members have lost post counts. None of the other Admins (incl. the Forum Founder) and Mods have deleted any messages.

The founder and I discussed a new member with a strange name over the weekend which she wanted to ban, because we thought it could be a hacker. (Btw..she's now deleting the person.)

To make things really strange none of us activated this member. And as of today, some of our members complained because they had lost post counts and we're not talking 20 or 50 posts...some of them have lost 12000 posts...!

When I logged on the the Admin panel, I also saw that the forum timezone was changed to Ashgabat.

What can I do? Or what can the founder do? Do you think we were hacked?

Also, daily backup was activated. How can I implement the backup? Will that restore the post count? And is there a way to secure the forum?

Thanks for your help!

mpelmmc wrote:Are you sure? I can see that the founder account hasn't connected since 2013

The founder account is the profile /u1 in your forum

Thanks...I have to go and check it out. I'm still learning...thanks for your patience.

Don't worry, we're here for that Please feel free to ask whatever dude you have about this in order to take the founder account back.

Also, once you have made yourself clear, don't forget to send to a staffer the information needed

Best regards.

If the original founder passed about, then following the instructions of this topic: https://help.forumotion.com/t81878-recovery-or-change-founder-of-an-account we can get the founder account passed on to you or another admin if you just send us a pm to ask.

Also sorry to hear of the loss of your founder.

mpelmmc wrote:Don't worry, we're here for that Please feel free to ask whatever dude you have about this in order to take the founder account back.

Also, once you have made yourself clear, don't forget to send to a staffer the information needed

Best regards.

Thanks. It's so good to have found the help we need. And all that because someone thought it was fun to delete messages and change our time zone. Can you please keep this thread open until we've done the backup...I'm sure there'll be some more questions along the way.

No problem, yes we will keep it open as long as you need.

If it will take longer then a week, make sure you bump once a week to prevent our auto purge from moving it.

brandon_g wrote:If the original founder passed about, then following the instructions of this topic: https://help.forumotion.com/t81878-recovery-or-change-founder-of-an-account we can get the founder account passed on to you or another admin if you just send us a pm to ask.

Also sorry to hear of the loss of your founder.

Sorry, it seems that I still haven't explained it properly. English isn't my first language.
The one that died was u2...she was also the one that set up the forum...we still don't know whose name she used as the founder...it could be any of the first 5 members...they see themselves as the forum founders, with u3 at the helm (so to speak)...it has always been a team effort...and still is. The one that died had all the necessary info though...she was a very remarkable Lady.

***

Also, if my answers take so long that's because I'm always switching between the help forum and "my" forum to tell the others whats going on...but now my bed is calling (I'm in Germany and it's 2 in the morning...the others are in the US...
I'll be back with in update later today or tomorrow regarding where you live. Thanks so far for all your help.

The account that matters to us is /u1 , that is the founder account and whoever has access to that account we can help. If no one currently has access to it, then we can give someone access if someone steps up and volunteers to take over as founder.

Without someone with access to the founder account or without giving someone access, them we can't be of much help.

Wait a minute!  When exactly did these issues occur?  Has it been a long time since you have been on the forum?  There has been some updates that could explain some of these issues like the changed timezone.

The founder is the one that has the address U1 at the and of the name that id the only founder account we need all the other accounts are just co admin or trusted staff members that have admin right's.

Sadly If that account holder is not about any more then we can not help you any more as it is him / her that we need to talk to here as they will have all the data we need to help more.

APE wrote:The founder is the one that has the address U1 at the and of the name that id the only founder account we need all the other accounts are just co admin or trusted staff members that have admin right's.

Sadly If that account holder is not about any more then we can not help you any more as it is him / her that we need to talk to here as they will have all the data we need to help more.

I wrote a PM with the infos and questions I have to SLGray. I can forward it to you too. It's complicated...as in fictional person/ dummy account complicated...more in the PM.

PM received.

SLGray wrote:PM received.

Thanks.
I just answered.

We lost posts again.
Can we do anything to stop that????

We're currently preparing all the things we need to ask for a transfer of founder rights. Still waiting for one Admin to get back to us with the required statement.

And another stupid question...can you "see" if we were hacked or are still being hacked?

I'll check in later around 4:30pm EDT...

The only way for your forum to get hacked is if someone broke into one of your admin of mods accounts. I would really check the logs cause it sounds like you either have a rogue mod or one of your admin or mods had their accounts hacked (meaning someone guessed their password). Your moderation log should tell who deleted the posts though one way or other.

brandon_g wrote:The only way for your forum to get hacked is if someone broke into one of your admin of mods accounts. I would really check the logs cause it sounds like you either have a rogue mod or one of your admin or mods had their accounts hacked (meaning someone guessed their password). Your moderation log should tell who deleted the posts though one way or other.

Thank you! I found the one who deleted our messages. It was an admin account. We just don't know right now if it was a hack or a mistake...54 threads were deleted in just 4 minutes...

We still need the transfer of founder rights though. Can't access the Utilities - Backup and Restoret without a new password.
Thanks again to all of you for your patience and help!

To be on the safe side, you may want to remove that admin's powers until you have the situation under control, otherwise it could keep happening.

brandon_g wrote:To be on the safe side, you may want to remove that admin's powers until you have the situation under control, otherwise it could keep happening.

If I remove that admin's powers for now, does she still have to okay the transfer of founder rights to a new founder?

I mean if she is going to be a permanent staff member again, sure, if not, then its up to you.

So the one you want to be the founder is doing this?

brandon_g wrote:I mean if she is going to be a permanent staff member again, sure, if not, then its up to you.

Thanks. Good to know.

SLGray wrote:So the one you want to be the founder is doing this?

No. The admin who deleted the threads would never willfully harm us. It was either a mistake or someone used her account. She complained today "that the board sticks at times and I have to wait for it to free up again."

We still haven't decided who will be our a new founder. And we're also waiting for one other staff member to get back to us...I hope we'll have everything done today (2018-07-26)..so that we can finally start the transfer.

If this was me I would remove the one deleting the posts from admin for now.

When you get a new Founder then they can ask that member for a new Email address and tell them to change the password to that account. This should be done by the new founder and the member who's account maybe hacked. and No one else should know this info NOT even the other Admin's.

APE wrote:If this was me I would remove the one deleting the posts from admin for now.

She was removed from Admin status.

APE wrote:When you get a new Founder then they can ask that member for a new Email address and tell them to change the password to that account. This should be done by the new founder and the member who's account maybe hacked. and No one else should know this info NOT even the other Admin's.

Okay. Good idea. Thanks.
I thought maybe we (Admins) should all change our passwords after the transfer. Just to be safe...

We've decided on a new founder!
Does she have to come here to ask for the transfer of founder rights herself...or can I do it and PM all the things that were mentioned in the "Recovery or Change Founder of an Account" under point 2???

It will be better if she comes here and provides all the data

mpelmmc wrote:It will be better if she comes here and provides all the data

Thanks. I sent her an email. She can provide the data via PM?

Yes. She can send all the data to me by PM if she wants to

Best regards.

Hi

I am asking for a transfer .. I will send pm to SLGray to provide data.

gem22 wrote:Hi

I am asking for a transfer .. I will send pm to SLGray to provide data.

Gem is going to be our new founder!


Hi Gem