Support

We recently had an intrusion through JCE that created false profiles and superusers. We got the hole plugged, all files sanitized or removed and all false profiles and superusers eradicated but I'm still getting an Admin Tools email warning of a file change on index.php.

This user does not exist. Any idea how to stop this email and still have Admin Tools warning about file changes? Thanks!

Here's the email I'm receiving several times a day:

Hello,

We would like to notify you that user webeditor19 (webeditor19 ) has just logged into the administrator backend area of your site, United Consumers Credit Union. Further information:

Username: webeditor19 (webeditor19 )
IP address: 31.220.1.242 (https://ip-lookup.net/index.php?ip=31.220.1.242)
Browser User Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36

If this is expected you do not need to do anything about it. If you suspect a hacking attempt, please log in to your site's back-end immediately and activate Admin Tools' Emergency Off-Line mode at once.

Best regards,
The United Consumers Credit Union team

Note: You are receiving this automatic email message because you are an administrator in United Consumers Credit Union. Do not reply to this email, it's sent from an unmonitored email address.

We figured it out. It was an our redundant hosting secondary site that was being affected, the emails just looked like they came from the primary. DOH!

Sorry for the trouble. We use Admin Tools and Akeeba backup on all our sites. Keep up the great work.