To all

It is Friday, 1/17/2014 at around 8:30 pm Pacific Std Time.

I am seeing the same issues with the website as noted yesterday--i.e.:

Quote:

And the forum is sluggish and unresponsive.

I recommend folks might want to stop posting until this is figured out--or at least copy and paste your posts to WordPad and save them on your system so you can go back and re-post them if you want later.

Edited:


There is a *Print* function that will bring up a text version of the thread--you can copy that and paste it to Word and you will have the entire thread saved in the order the posts were made.  One will have to manually recreate the thread later, but it can be done

NightOwl wrote on Jan 17^th, 2014 at 10:56pm:


I just tried it with Chrome and scripting turned on, but didn't see any problems.



Quote:


I take it you moderators have ftp access to radified.com/cgi-bin/yabb2, right?  If so, can you just make copies of a couple of the subfolders in yabb2?

It's been years since I ran a couple forums myself but I used the same YaBB software (albeit an older version than what Rad's running now).  IIRC there should be a couple folders called something like "Messages" and "Boards" or something like that.  Those were the two folders I used to keep judiciously backed up.

All the scripts and css stuff should be in other folders and would be the targets of any hacking attack (because Messages and Boards don't contain any scripts or anything executable).  If you have a current copy of Messages and Boards and Rad has to restore the forum from an old backup again, the restore will fix the forum *infrastructure* and a straight recopy of the two folders should bring the forum *content* current again.

This morning (Saturday) I had the studly dude at my web host runs the script to check for instances of the vacance- name, and the only hits came from html files where I/we had mentioned it ourselves.

So we are good .. as of Saturday morning, 9AM Pacific.

Plus I changed my site log-in password .. yet again.

you could have gotten the infected files before the destination server got overloaded.

that's really what made the hack so apparent.

NightOwl wrote on Jan 22^nd, 2014 at 2:12pm:


The forum software is written in perl, and part of the beauty of perl is it's tailor made to use text files for everything, from the program itself (perl scripts in text format) to the data files (also in text format).

I dragged a backup of one of my old forums out of storage to refresh my memory.  According to the footer on this forum Rad is running YaBB 2.4, while my old forums were on YaBB 1.4.  It's probably generally similar, but take that as a disclaimer for the following comments below.

The Boards directory contained a series of text files that were basically related to the forum structure--names and locations of the forum's msg boards and an id that may have pointed to each board's most recent post.

The Messages directory contained a series of text files representing all msgs for all boards, lumped into this one directory.  Each post was stored separately as a pair of text files--one file being the post's contents and the other an index to where (which board and thread) the post belonged.  The posts could be read individually but not as a thread because everything was lumped together in one directory.

Hover over a thread link when you're looking at the index to any board and notice the url to where the link points.  See that long numeric string?  That's the post's id number and the actual post is stored in the Messages directory as a pair of files with that id number.  (Note: I haven't explored where pics or uploads go.)

Those two directories contain the names, contents and indexes of all the boards, so should serve as a drag-and-drop backup of the contents of the entire forum.  They do not contain the colors, layout, member list, or any parts of the forum that could be the called the infrastructure.

It should be easy to automate backups--my linux is rusty but I'm sure Rad can easily setup a cron job on the server.  Maybe he's been doing that already, but I don't know on what time schedule.

To all

It's about two weeks since the forum was hacked--looks like the problem has been removed, and we have been without incident since mid-January.  So, folks should be able to post without worry.

So, no saving copies of your posts for re-posting because they might be lost--we're not anticipating any ongoing problems based on our current status.