Web Wiz - Green Windows Web Hosting

  New Posts New Posts RSS Feed - database corruption...any tools?
  FAQ FAQ  Forum Search   Events   Register Register  Login Login

database corruption...any tools?

 Post Reply Post Reply Page  12>
Author
billd3 View Drop Down
Senior Member
Senior Member


Joined: 19 February 2003
Location: United States
Status: Offline
Points: 530
Post Options Post Options   Thanks (0) Thanks(0)   Quote billd3 Quote  Post ReplyReply Direct Link To This Post Topic: database corruption...any tools?
    Posted: 28 December 2009 at 8:08pm
I'm now 100% convinced that we have database corruption.
For a month now we've seen ordinary posts suddenly become calendar events (yes, it just seems to happen at random!)
And now all announcements are GONE.
I'm the one and only person who ever does any announcements, ever. I'm the only one with admin credentials and who knows the id and password and today I noticed that an announcement I'd made - which I created as an announcement all forums was gone, as were all other announcements!
WOW!
They just as of today are GONE.
Actually it might have happened a day or two ago since we lost Internet connection due to ice and snow so for the weekend getting Internet at all was hit and miss. But today I'm thinking, gee, something looks different - and sure enough - no announcements.
And there's another post that has suddenly become a calendar event even though it was NOT an event when it was posted, and it wasn't edited until I edited it today to make it a NON-event post.
Since if anyone edits a post it's put in the post that it was edited, when and by who - I can tell this is happening by magic and it really scares me.
At first I thought that when for the last couple of months when folks asked me "hey, where's my post, why did you delete it" they had simply lost track of it, now I'm believing them - they simply disappear!

Have we been hacked? (we're hosted here..........)

I guess I'm wondering - is there any tool available to check the integrity of the SQL database?????
Backups are fine and dandy, but we get so many posts that by the time we discover thigns are missing, a restore would be worse than the lost posts!
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 28 December 2009 at 8:41pm
Corrupted SQL Server database NEVER behave in this way. Someone is doing this.

You may have accidentally given a user moderator rights or one of your moderators is doing this.

Moderators are able to use the 'Topic Admin' window from the Moderator drop down to change topics, for example delete, change to a calendar event, change announcement status, etc. and because the post itself is not edited it dose not place an 'edited by' within the post.

Another reason for this issue to happen would be due to a modification which has opened a hole for a hacker to mess around with your forum.

The first thing to do is to upgrade your forum to the latest unmodified version of Web Wiz Forums.

The next thing to do is to track what your moderators are doing as I suspect it is one of them doing this. You should edit in notepad the file includes/setup_options_inc.asp and enable logging for moderator actions, this will then mean you have a log file which will tell you when a moderator has delete, edit, remove/add announcement, change calendar events, etc. It will tell you who has done it, a date and time, and their IP.
Back to Top
billd3 View Drop Down
Senior Member
Senior Member


Joined: 19 February 2003
Location: United States
Status: Offline
Points: 530
Post Options Post Options   Thanks (0) Thanks(0)   Quote billd3 Quote  Post ReplyReply Direct Link To This Post Posted: 28 December 2009 at 9:29pm
Logging is enabled - so that's a tool that can be used I guess. I enabled it months ago when we had issues with a user removing posts he'd made then claiming he'd never done any such thing.......
It's enabled for all so I'd have to do some real digging.
I can count out bad or rogue moderators being added as i've not even been to that section in the admininstration area in many months. It's a "these are the moderators and that's it" deal. Once it was setup, we agreed that was it.

I've also documented the modifications to the forum - the only 'mods' are in appearance - CSS files, colors, table backgrounds, etc. or the addition of the links near the top of the page and the breadcrumbs near the bottom of the page. I've documented all of this in preparation for an upgrade - as we all like the latest improvements and additions... so I've recently compared our files to the original install files, and very little was actually changed, and those changes are now in writing. Formatting and layout only.
I documented what was changed so when we upgrade (I'll open a ticket on that!) it will be easy for me to put the colors back, to links and donation button near the top, the breadcrumbs and re-add the smilies I put in.
We did use the "mobile "mod"" for a while, but that's exactly when the calendar events went screwy, so I killed that quickly.  I deemed it too risky..........

Of the 5 of us moderators, only 3 of us are even brave enough to do more than "talk about posts" - 2 for sure are so scared of messing up, they won't even move posts..........they tell me to do it!
So that leaves me and 2 others. I trust all of the moderators beyond how most folks trust a brother or wife. If anything ever happened, it would be pure accident. And most don't bother with actual actions, they simply chew on people and tell 'em to shape up or leave. Those that don't are suspended.
I'm the only one with the keys to the admin account. And I login only on rare occasions to resynch the posts, etc. - otherwise I don't even login as admin very often. Just too risky. Never use the admin account for daily use!

I think it's time to prepare for an upgrade......... and to be safe AFTER the upgrade, I'll change the administrator password.

>>change to a calendar event, change announcement status, etc. and because the post itself is not edited it dose not place an 'edited by' within the post.<<

Hmmmmmm, I'd not thought of that.................  LOL - thanks. Will look into that as a possibility.

BillD
http://theamcpages.com
http://theamcforum.com
Back to Top
WebWiz-Bruce View Drop Down
Admin Group
Admin Group
Avatar
Web Wiz Developer

Joined: 03 September 2001
Location: Bournemouth
Status: Offline
Points: 9844
Post Options Post Options   Thanks (0) Thanks(0)   Quote WebWiz-Bruce Quote  Post ReplyReply Direct Link To This Post Posted: 28 December 2009 at 10:12pm
I've looked at your forums database for you to check on the status of moderators and you have more than 5, as well as 6 in your moderator group you also have 3 members with individual permissions setup to moderate various forums, anyone of these members can change things in your forum in the way you describe.

As I mentioned before this will 100% not be coursed by any type of database corruption, someone will be doing this.

Having logging enabled for all is NOT good on a large forum like yours as it will place to much strain on the forum engine. You should enable it for moderator actions only on larger forums. This will also help you track down who is doing this to your forum.


Edited by WebWiz-Bruce - 28 December 2009 at 10:20pm
Back to Top
billd3 View Drop Down
Senior Member
Senior Member


Joined: 19 February 2003
Location: United States
Status: Offline
Points: 530
Post Options Post Options   Thanks (0) Thanks(0)   Quote billd3 Quote  Post ReplyReply Direct Link To This Post Posted: 28 December 2009 at 10:20pm
Ah, forgot about Frank and Scott - they moderate a couple small sections, but have no moderator rights outside of the lost dealership project and perhaps another.
Tom has rights to one section but he can't figure out how to post most of the time, so might as well remove him as a moderator and just make him a "super user" in that section.
But none of them have any rights beyond normal membership for the forum in general - they are moderators to specific sections they are sort of in charge of -

I'll go in an "turn off" logging except moderators since the little problem earlier is since gone..... he forced us to suspend him.
BillD
http://theamcpages.com
http://theamcforum.com
Back to Top
billd3 View Drop Down
Senior Member
Senior Member


Joined: 19 February 2003
Location: United States
Status: Offline
Points: 530
Post Options Post Options   Thanks (0) Thanks(0)   Quote billd3 Quote  Post ReplyReply Direct Link To This Post Posted: 29 December 2009 at 3:26am
I guess I didn't have all the logging turned on that I THOUGHT I did. I only have edit/delete posts, moderator actions and one other thing - oh, new members, turned on to TRUE.
The logs were typically very small - 1K to 2 or 3K with just a half dozen lines each log with a few exceptions when house-cleaning took place every few weeks. So logging wasn't as heavy as I'd thought as I didn't have much set to true.
BUT, I did have enough set to true to find where at least two posts went! I'll have to have a talk with him about this..........  LOL
I can't find anything at all about the posts that "turn to events" however, nothing. Not a thing related to that. One happened again this week, but I find no indication that the particular post that ended up on the calendar was messed with in the logs....... unless THAT part doesn't get logged, which I guess is possible.
 
I did find what happened to at least 2 posts, though, and this is a bit perplexing.........
Can someone explain - if I login as the REAL administrator with the admin account and password, and the ADMIN is the ONLY person who can make an "announcement, all forums" - how is it possible that a lowly moderator can actually DELETE such a post - if admin made it as an announcement, all forums??
 
I can't explain the calendar events still - I have seen them cover a week, a weekend, a day, 2 or 3 days, and I've seen them with start dates and no end dates. I can't figure how a simple post ends up like that and SO OFTEN! I've changed/edited probably 20 or 25 of them in the last month or so.
They really had the calendar screwed up badly.
BillD
http://theamcpages.com
http://theamcforum.com
Back to Top
Shaun View Drop Down
Groupie
Groupie


Joined: 24 February 2006
Status: Offline
Points: 78
Post Options Post Options   Thanks (0) Thanks(0)   Quote Shaun Quote  Post ReplyReply Direct Link To This Post Posted: 29 December 2009 at 5:31am
Hi Bill,

I'm with Bruce on this one, I suspect you have some permissions that don't make sense and are there by mistake (yours LOL).

Concerning Calendar events, I have had a look at your forums and can confirm the following.

You have Calendar Permissions for ALL user groups enabled in the following Sections:

Drag Racing
Autocross, Circle Track
Jeeps and 4X4
Charity Projects

And understandably:

Upcoming Shows & Events (and the Sub Forum)
AMO
NAMDRA
AMCRC

^^Those 4^^, obviously they are relevant to Events / Meets etc

But the top 4..?

That's a lot of forum sections to have the calendar enabled for and I was a little surprised to see that a forum n00b with zero posts has been given permissions to create a calendar thread.

I was not able to test your Trade Sections.

Calendar threads do NOT need an end date (just to tie up one of your points).

Moderators - They can edit threads made by the Admin Group. A thread made by Admin in a section a Mod can view, can be edited by a Mod.

I think your forum permissions are a little bit muddled up and need reviewing ASAP.

I've seen all of what you are describing before LOL.. It is user error (and most likely friendly mistakes by yaself and the Staff Team). This is nothing unfriendly or untoward.

I also own and run a Car Forum, we've been going since 2002 now and are pretty big. I've also been administrating WWF forums since the very early days as well, so I'm very well versed etc.

If you need a hand sorting out or reviewing these probs you have at the moment, please feel free to throw me a PM fella.

Many thanks and take care,
Shaun
Back to Top
billd3 View Drop Down
Senior Member
Senior Member


Joined: 19 February 2003
Location: United States
Status: Offline
Points: 530
Post Options Post Options   Thanks (0) Thanks(0)   Quote billd3 Quote  Post ReplyReply Direct Link To This Post Posted: 29 December 2009 at 1:04pm
10 posts are required to post in the sale section. Helps cut down a bit on the "drive by sellers" who join, post a sale ad, then never return.
SPAMMERS, well, we don't have terrible problems there as poormansmachine is so anti-spammer, he's killing them nearly as fast as they can join or post - often suspending them as quick as he sees they have joined.

I'll double-check permissions.......... calendar events have actually been showing up in the areas where folks don't have calendar permissions - in the general chat and off-topic areas! That's amazing since there aren't permissions there for "events".
6 moderators in the mod group? There's only 5 of us, plus those 3 with individual permissions to specific sections - unless the admin counts as a moderator?

But the fact that a post in pretty much ANY area, even where no one has permissions to create a "calendar event" is baffling me...... The post is made, it's a normal, say it's in the general chat area, then a couple weeks later, suddenly it's an "event"........... and events aren't even enabled in that area.

poormansmachine did admit to the mistake of removing the "announcements.
He went to the very old posts deep into the sale section and of course, those announcements show up at the top of each page, and he figured anything on page 20 or above was very old, so........ and didn't realize he was removing announcements. So THAT mystery is solved. I went into our hidden moderator section where we discuss business and posted the 3 lines from the LOGS that showed when and who and he replied - whoops, sorry, didn't realize they would appear back there..collateral damage..
BillD
http://theamcpages.com
http://theamcforum.com
Back to Top
 Post Reply Post Reply Page  12>

Forum Jump Forum Permissions View Drop Down

Forum Software by Web Wiz Forums® version 12.08
Copyright ©2001-2026 Web Wiz Ltd.


Become a Fan on Facebook Follow us on X Connect with us on LinkedIn Web Wiz Blogs
About Web Wiz | Contact Web Wiz | Terms & Conditions | Cookies | Privacy Notice

Web Wiz is the trading name of Web Wiz Ltd. Company registration No. 05977755. Registered in England and Wales.
Registered office: Web Wiz Ltd, Unit 18, The Glenmore Centre, Fancy Road, Poole, Dorset, BH12 4FB, UK.

Prices exclude VAT at 20% unless otherwise stated. VAT No. GB988999105 - $, € prices shown as a guideline only.

Copyright ©2001-2026 Web Wiz Ltd. All rights reserved.