Hacked??

[Arba]

 
I dont know what is going on ,as usual ,yesterday everything was fine with my forum and site ,this morning I log to my forum and saw -one member whaiting aproval- (I do not allow automatic registration nowhere in my site ,smf forum,gallery,...and all new members need aprowal ,do that to prevent hacking  ) .I try to log in my smf administration clicking on - one members whait aprovall - insert my pasword and nothing ,at the bottom of the age is writed -done- but I still stay on the admin log page.
I try to log via -admin- button in forum menu and that was sucesfull .
Saw new members name - neabyzteplz - his ip - 210.21.75.114  - his e mail - loginnpe@cashette.com ,and  know that is hacker .Try to delete him but nothing hapening ,check reject box,click to delete but zerro succes ,I was unable to delete him ,my forum admin do not respond to anything .For test I try to start new topic without succes .My forum not respond to anything .
I go to mambo administration (I have mambo too ) and get blank page -cannot find server .go to mail folder -same story ,cannot find server ,blank page.
Go to my cpanel ,succesfull loged but when I try to wiev files in file manager ,I can saw them but when I click on ,for example - mail cannot open file.......

OK that is ridicolous,just check again all what I writed above and now everything is back to normal .
My smf admin work normal,I can post new topic,and reach mambo admin and mail ,as is nothing hapening.
I was thinking to cancel this topic but anyway maybe someone get in similar situation and this topic can help .
Personaly I think that problem with my site is related with new member (who are not aproved and is finnaly sucesfully erased from my smf forum) .
In file directory> mail> inbox > I find only this document:
From MAILER-DAEMON Mon Aug  7 03:46:54 2006
Date: 07 Aug 2006 03:46:54 -0700
From: Mail System Internal Data
Subject: DON'T DELETE THIS MESSAGE -- FOLDER INTERNAL DATA
Message-ID: <XXXXXXX> (edited mail adress)
X-IMAP: 1152134158 0000000055
Status: RO

This text is part of the internal format of your mail folder, and is not
a real message.  It is created automatically by the mail system software.
If deleted, important folder data will be lost, and it will be re-created
with the data reset to initial values.

From MAILER-DAEMON Sun Aug 27 18:32:01 2006
Return-path: <>
Envelope-to: xxxxxxxxxxxx
Delivery-date: Sun, 27 Aug 2006 18:32:01 -0700
Received: from mailnull by xxxxxxxxxx.com with local (Exim 4.52)
   id 1GHVyr-0001ll-PW
   for xxxxxxxxxxxxx; Sun, 27 Aug 2006 18:32:01 -0700
X-Failed-Recipients: loginnpe@cashette.com
Auto-Submitted: auto-generated
From: Mail Delivery System
To: xxxxxxxxxxxxxx
Subject: Mail delivery failed: returning message to sender
Message-Id:
Date: Sun, 27 Aug 2006 18:32:01 -0700

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

  loginnpe@cashette.com
    SMTP error from remote mail server after RCPT TO::
    host smtp.cashette.com [216.218.158.109]: 550 :
    User unknown in local recipient table

------ This is a copy of the message, including all the headers. ------

Return-path:
Received: from xxxxxxxxxxxxx with local (Exim 4.52)
   id 1GHVyp-0001lD-HK
   for loginnpe@cashette.com; Sun, 27 Aug 2006 18:31:59 -0700
To: loginnpe@cashette.com
Subject: Welcome to Elegancereef
From: "Elegancereef"
Date: Mon, 28 Aug 2006 01:31:59 +0000
X-Mailer: SMF
Content-Type: text/plain; charset=ISO-8859-1
Message-Id:


Your registration request at Elegancereef has been received, neabyzteplz.

The username you registered with was neabyzteplz and the password was Kiac7kdULd.

Before you can login and start using the forum, your request will be reviewed and approved.  When this happens, you will receive another email from this address.

Regards,
The Elegancereef Team.


Can I delete this file?

[G6Cad]

Yes, you can delete that, it's simply a mail deamon that tells you that the email adress from the user registerd doesent exist, so he/she didnt get the mail from your forum.

As for the other things with blank pages and not be bale to login i dont know what think.
Maby your host was doing something at the very same time so you didnt have the correct access at that time 

[Arba]

Thank you for your reply and answer.
I really dont know what was going on ,before I open this topic I try to dealed few hours with that issue.
I am not sure that is host server  problem because my site was up ,everything worked except administrations (smf administration and posting,mambo administration,mail administration) ,anyway hope that everything will be fine now .
Hate that situations because I dont have a clue what to do then and afraid to do more damage then good with my actions  .That is the reason why I always ask here  what to do 

[Arba]

Maby your host was doing something at the very same time so you didnt have the correct access at that time 
hmm ,after second thought maybe you are right  :up:

[IchBin]

I have banned about 5 different emails that constantly try and register to spam. Cashette is one of them... lol

Sounds like a server issue to me to Arba. I wouldn't worry about that registration.