Random Blank User Accounts

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • CozmicShredder
    Member
    • Aug 2004
    • 50
    • 4.2.X

    [Forum] Random Blank User Accounts

    Not sure whats going on am thinking it's something in a cron job with a plugin or mod but cannot seem to find anything on this anywhere...

    I keep getting these random user accounts created with no information other date and activity... It doesn't happen all day or everyday it's more or less random...

    Basically like below





    Showing Users 1 to 25 of 2582
    User Name Email Join Date Last Activity Post Count Options
    12-31-1969 12-31-1969 0


    I am trying to look through the log files... Not seeing much of anything...

    I am using vBulletin 4.2.0 Patch level 3

    This all started about the middle of last month...
  • Zachery
    Former vBulletin Support
    • Jul 2002
    • 59097

    #2
    What happened prior to the middle of last month that was new? new/updated addons? modifications?

    Comment

    • Lynne
      Former vBulletin Support
      • Oct 2004
      • 26255

      #3
      Do they have entries in all three of the user tables in the database - user, userfield, and usertextfield - and is the username blank there too?

      Please don't PM or VM me for support - I only help out in the threads.
      vBulletin Manual & vBulletin 4.0 Code Documentation (API)
      Want help modifying your vbulletin forum? Head on over to vbulletin.org
      If I post CSS and you don't know where it goes, throw it into the additional.css template.

      W3Schools <- awesome site for html/css help

      Comment

      • TheLastSuperman
        Senior Member
        • Sep 2008
        • 1799

        #4
        Hmm I've seen similar behavior on other sites... my question is... in the email you receive about a new user, does it show any form of info about their userid? What I found odd in the situation I encountered was the fact that 1) The users did not exist yet emails were sent to the site owner and 2) The userids were "from the future" i.e. a userid of let's say 9999 when the most current userid on the site would have been 4590 for example i.e. userid 9999 cannot exist.

        So were these accounts actually created and you see them in your user list OR were these just emails that were "false alarms" ?

        Edit: Ahh I see you mentioned logs so I take it these were actually created then!?!


        Former vBulletin Support Staff
        Hacked recently? See my blog post "Recovering a Hacked vBulletin Site".
        Thinking outside the box? Need modification support? Visit www.vBulletin.org and have at it!

        Comment

        • CozmicShredder
          Member
          • Aug 2004
          • 50
          • 4.2.X

          #5
          Password date in Database shows 0000-00-00

          As far as the user id it seems to be escalating normally the latest one was 2809 my websites current number is 2806

          I am about to disable addons...



          Last edited by CozmicShredder; Fri 1 Mar '13, 1:45pm.

          Comment

          • CozmicShredder
            Member
            • Aug 2004
            • 50
            • 4.2.X

            #6
            I am still going ape about this issue! Grrr! I cannot believe nobody but me in the entire world of vBulletin has this issue!

            What should I look for that would even make an account? Could it be something set to the cron job or a spammer bot trying to make an account?? What should I look for when I am sleuthing for what the root cause is or what are the steps needed???

            I guess I will have to disable every product and enable it one by one waiting at least one day but would be easier to know what could be lurking with info that would make an account where there was no account...

            Comment

            • Trevor Hannant
              vBulletin Support
              • Aug 2002
              • 24325
              • 5.7.X

              #7
              If you login to your database and check the AutoIncrement values in the following tables:

              - user
              - userfield
              - usertextfield

              Take the highest number from each of those tables and set the others to the same.

              Does this resolve the problem?
              Vote for:

              - Admin Settable Paid Subscription Reminder Timeframe (vB6)
              - Add Admin ability to auto-subscribe users to specific channel(s) (vB6)

              Comment

              • CozmicShredder
                Member
                • Aug 2004
                • 50
                • 4.2.X

                #8
                Hey thanks Trevor, I did what you said was shocked there were some blank areas there! I will post here in a few days if it still happens...

                Comment

                • CozmicShredder
                  Member
                  • Aug 2004
                  • 50
                  • 4.2.X

                  #9
                  A day later and still creating blank user accounts... Really confused now... Am thinking there is something where people are trying to create accounts or there is a cron job running adding members maybe from a plugin,,, Will have to do the trial and error thing which will take weeks...

                  Comment

                  • BirdOPrey5
                    Senior Member
                    • Jul 2008
                    • 9613
                    • 5.6.3

                    #10
                    Well first go to plugin manager (plugins not products) and look at the list of hooks. If you see ANY products using a hook with the word "register_" in it, those would be prime suspects.

                    Comment

                    • davidsw
                      New Member
                      • Oct 2013
                      • 2
                      • 4.2.X

                      #11
                      Where you ever able to figure out what the problem was? I now have the exact same problem with my installation. You can have a look at the attach image how it looks in the admin pages. There seems to be entires in the user table only so no entry in the userfield table for the blank users which I have for every other user. I have checked for hooks with "register_" in them without finding any.

                      Is it ok to just delete the blank users directly from the user table? It is not possible to delete them from the admin pages.

                      Comment

                      • CozmicShredder
                        Member
                        • Aug 2004
                        • 50
                        • 4.2.X

                        #12
                        Originally posted by davidsw
                        Where you ever able to figure out what the problem was? I now have the exact same problem with my installation. You can have a look at the attach image how it looks in the admin pages. There seems to be entires in the user table only so no entry in the userfield table for the blank users which I have for every other user. I have checked for hooks with "register_" in them without finding any.

                        Is it ok to just delete the blank users directly from the user table? It is not possible to delete them from the admin pages.
                        My site was being hacked at the time had no idea and a few months later someone just found the files and wiped my website but realized somehow someone loaded a bunch of backdoor files back in Nov. 2012 and just about anyone surfing for those files could access my forums and modify it... All I did was review the Apache logs and found when they created it and who was loading files or accessing seems some of them just googled and found my site was vulnerable took forever for me to find the path from the apache logs... Anyways your issue might have been different but either way make sure you know your directory files and that you delight anything your not using... Also make sure all your plugins are running that supposed to be running...

                        Comment

                        • davidsw
                          New Member
                          • Oct 2013
                          • 2
                          • 4.2.X

                          #13
                          Thanks for the answer! However, in my case I do not think this is the prolem. This forum is not available from outside the internal network and I do not think that anyone from inside is doing any modifications. I'm trying to find a pattern for the inserted blank user accounts and I'm suspecting that the problem is related to a plugin or a scheduled task that is running. The question is, how do I found out which? The other questions is if I can delete the empty accounts?

                          Comment

                          Related Topics

                          Collapse

                          • nfinity
                            Login Session
                            by nfinity
                            Hello.

                            As your staff talked, I asked my problem at vbulletin.org. I think they don't work briskly, I couldn't get help. Is there any tip of this?

                            I have own my site. I try to...
                            Tue 27 Nov '12, 3:53pm
                          • nfinity
                            Share login session
                            by nfinity
                            Hello.

                            I have own my site. I try to use VB5 as my forum. So I need to use my login session with VB5.
                            What can I do.
                            The other question is;
                            If I change some on login page,...
                            Mon 26 Nov '12, 8:05pm
                          Working...