So,,,, a site that I maintain was shut down due to bulk email, which appears to have been initiated from our DNN installation.  The email account associated with the host account was sending out 15,000+ emails (grrrrrrrrrrrrrrr!!!)

I deleted the offending email account, changed passwords for my host and admin accounts on DNN, updated the host and admin account email addresses, updated the SMTP settings.  Is there anywhere else I should look at or anything else I should do to stop this?   It's not the first time one of my DNN sites has been hacked!  I am currently running 5.5.1 and am upgrading to 5.6.1 ASAP.

I checked the files in this installation and can't find anything obvious, except that the web.config file was changed today - I haven't done anything to it.  I couldn't find anything glaring that was changed.

I noticed in the site log a ton of exceptions before they supended my site, and then a ton afterwards.  Before suspension, they all have the following portal ID of -1, which I find curious.  Any insight or help would be greatly appreciated.

AssemblyVersion: -1
PortalID: -1
PortalName:
UserID: -1
UserName:
ActiveTabID: -1
ActiveTabName:
RawURL:
AbsoluteURL:
AbsoluteURLReferrer:
UserAgent:
DefaultDataProvider:

Check, whether hacking has been done using DNN or by directly accessing the SMTP server.

---

Cheers from Germany,
Sebastian Leupold

   

Speed up your DNN Websites with TurboDNN

What was the content of the emails?

Were they logged in as your Admin account and simply using the Newsletter (bulk email) page?

---

Chris Hammond
Former DNN Corp Employee, MVP, Core Team Member, Trustee
Christoc.com Software Solutions DotNetNuke Module Development, Upgrades and consulting.
dnnCHAT.com a chat room for DotNetNuke discussions