Advertisement:

Author Topic: Suspicious activity  (Read 3834 times)

theinvisible

  • Sr. Member
  • ****
  • Posts: 311
Re: Suspicious activity
« Reply #15 on: July 26, 2017, 07:37:38 am »
I can't access my website now. It shows the maintenance mode. But when i tried to login the admin dash, it gives me blank page in return.

tito

  • issues
  • Sr. Member
  • *
  • Posts: 397
Re: Suspicious activity
« Reply #16 on: July 26, 2017, 07:44:41 am »
Did you updated to 3.7.4?

I also had the same after the update

Try if you have acces to yoursite/oc-admin/index.php?page=tools&action=maintenance

theinvisible

  • Sr. Member
  • ****
  • Posts: 311
Re: Suspicious activity
« Reply #17 on: July 26, 2017, 07:48:32 am »
My site has automatic updates. admin login page is available. but when i enter the credentials and tried to login, it gives a blank page. with mysite/oc-admin/index.php


so i can't even turn off the maintenance mode.

tito

  • issues
  • Sr. Member
  • *
  • Posts: 397
Re: Suspicious activity
« Reply #18 on: July 26, 2017, 08:01:11 am »
can you check the error logs?

_CONEJO

  • Administrator
  • Hero Member
  • *****
  • Posts: 4689
Re: Suspicious activity
« Reply #19 on: July 26, 2017, 09:59:19 am »
Access your site via FTP, on the root folder of your website there should be a file called ".maintenance" remove it and your website should be accessible again.

theinvisible

  • Sr. Member
  • ****
  • Posts: 311
Re: Suspicious activity
« Reply #20 on: July 26, 2017, 12:00:43 pm »
Access your site via FTP, on the root folder of your website there should be a file called ".maintenance" remove it and your website should be accessible again.

did what you said and site came online again. But still i can't access the admin dash.


can you check the error logs?

sorry man i don't know how to check it

marius-ciclistu

  • issues
  • Hero Member
  • *
  • Posts: 1652
  • "BE GRATEFUL TO THOSE THAT SUPPORTED YOU"
Re: Suspicious activity
« Reply #21 on: July 26, 2017, 12:27:48 pm »
1.You can look in your ftp root folder for a folder called logs.
2.You can enable Debug
https://doc.osclass.org/Debug_PHP_errors
You can put this
Code: [Select]
/**
 * Copy this code to config.php file
 * This will log all error notices and warnings to a file called debug.log in oc-content
 */
define('OSC_DEBUG', true) ;
define('OSC_DEBUG_LOG', true) ;
in your config.php file.
In oc-content is the place to put an empty file called debug.log with 666 permissions.
The first choice has already the errors, if any,
The second will be populated with them from now on if you hadn't enabled it so far.

Edit:
Regarding changing your password from phpMyAdmin, you can do it, but you must find out what hash is used by osclass for storing pw.(I never done it in osclass, but I've done it in WP).
« Last Edit: July 26, 2017, 12:32:29 pm by marius-ciclistu »

theinvisible

  • Sr. Member
  • ****
  • Posts: 311
Re: Suspicious activity
« Reply #22 on: July 26, 2017, 12:46:22 pm »
the logs contain a .gz file.

marius-ciclistu

  • issues
  • Hero Member
  • *
  • Posts: 1652
  • "BE GRATEFUL TO THOSE THAT SUPPORTED YOU"
Re: Suspicious activity
« Reply #23 on: July 26, 2017, 12:47:06 pm »
Download it and extract it.

theinvisible

  • Sr. Member
  • ****
  • Posts: 311
Re: Suspicious activity
« Reply #24 on: July 26, 2017, 12:52:15 pm »
done. then?

marius-ciclistu

  • issues
  • Hero Member
  • *
  • Posts: 1652
  • "BE GRATEFUL TO THOSE THAT SUPPORTED YOU"
Re: Suspicious activity
« Reply #25 on: July 26, 2017, 12:54:32 pm »
Open the log files with a text editor for example and see the errors, maybe post them here after removing the info that is better to remain undisclosed like your url, location etc.

theinvisible

  • Sr. Member
  • ****
  • Posts: 311
Re: Suspicious activity
« Reply #26 on: July 26, 2017, 01:00:29 pm »
Open the log files with a text editor for example and see the errors, maybe post them here after removing the info that is better to remain undisclosed like your url, location etc.

the file contains too many lines.. how do i distinguish an error?

Aficionado

  • Guest
Re: Suspicious activity
« Reply #27 on: July 26, 2017, 01:07:05 pm »
I have never seen a debug GZ log file. WHY GZ ?
« Last Edit: July 26, 2017, 01:23:48 pm by Aficionado »

theinvisible

  • Sr. Member
  • ****
  • Posts: 311
Re: Suspicious activity
« Reply #28 on: July 26, 2017, 01:08:57 pm »
i'm posting last 3 lines here

ip - - [25/Jul/2017:09:15:10 -0400] "GET / HTTP/1.1" 200 38463 "http://www.mysite.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:54.0) Gecko/20100101 Firefox/54.0"
ip - - [25/Jul/2017:09:15:14 -0400] "GET /user/register HTTP/1.1" 200 23514 "http://www.mysite.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:54.0) Gecko/20100101 Firefox/54.0"
ip - - [25/Jul/2017:09:15:14 -0400] "POST / HTTP/1.1" 200 - "Osclass (v.373)" "-"

marius-ciclistu

  • issues
  • Hero Member
  • *
  • Posts: 1652
  • "BE GRATEFUL TO THOSE THAT SUPPORTED YOU"
Re: Suspicious activity
« Reply #29 on: July 26, 2017, 01:15:50 pm »
I have never seen a GZ log file. WHY GZ ?
For example my host archivates the logs once in a while.