Being overrun by [email protected]

Rate this topic: Evaluations: 1, 1.00 on the average.Evaluations: 1, 1.00 on the average.Evaluations: 1, 1.00 on the average.Evaluations: 1, 1.00 on the average.Evaluations: 1, 1.00 on the average.Evaluations: 1, 1.00 on the average.1.00 out of 6 based on 1 vote(s)
GK User
Fri Feb 07, 2014 11:21 pm
Reply with quote
Report this post
Has anyone else run into this? The user "[email protected]" is spawning everywhere. If I try and remove it as a user it respawns two more. I tried to remove it from the database and the same thing happened.
Feeling like I have been hit by a massive malware. Would hate to have to rebuild everything.
Any help is appreciated.
jkvt
User avatar
Junior Boarder

GK User
Fri Feb 07, 2014 11:37 pm
Reply with quote
Report this post
Hi,
did you have "admin" login to /administrator ?
If yes.... upsss

1) Disable registration
2) Check maybe someone hack your website.
3) Rename [email protected] e-mails to any other.
User avatar
Platinum Boarder

GK User
Sat Feb 08, 2014 3:21 am
Reply with quote
Report this post
Hi Pawel,
Thanks for the answer, however...
1) The user "gkadmin" with email [email protected] comes in as disabled.
2) Not being bale to remove this user has me thinking that hacking is a possibility.
3) Tried renaming, as well as removing the user. Every time I try it spawns another. Up to 35 of them now.

When I try and delete or change it gives the error "Save failed with the following error: User name in use".



Pawel F wrote:Hi,
did you have "admin" login to /administrator ?
If yes.... upsss

1) Disable registration
2) Check maybe someone hack your website.
3) Rename [email protected] e-mails to any other.
User avatar
Junior Boarder

GK User
Sat Feb 08, 2014 9:22 am
Reply with quote
Report this post
It's not normal...by the way, did you checked hacking possibility ?
Ask your hosting provider what is happening.
Maybe hire someone who will analyze your source code.
In mean time:
1) Change all superadmins - logins and passwords
2) Change password for data base -- then change in configuration.php
3) set OFFLINE mode and check if this will appears again.
User avatar
Platinum Boarder