1) The quickest way to recover your wiki is to do a database restore from the previous days backup, this will only work if you have a backup and if you wiki doesn't have to many good edits each day. 2) I don't know if 1.5 is any better for this but I believe there is a captcha add-on project you can use. You can also increase the number of posts any one IP can make in given time frame. 3) IP's aren't very usefull as most people use dynamic IP's and a lot of ISP's route all / a lot of there users through proxys. Arthur Guy arthur(a)astarsolutions.co.uk a star solutions www.astarsolutions.co.uk Audio & Video Leads Adapters and Accessories -----Original Message----- From: mediawiki-l-bounces(a)Wikimedia.org [mailto:mediawiki-l-bounces@Wikimedia.org] On Behalf Of Cyril Pavillard Sent: 22 October 2005 23:32 To: mediawiki-l(a)Wikimedia.org Subject: [Mediawiki-l] Wiki vandalized Hello, I hope this is the right place to request some support for this subject. Our wiki (http://www.wikimac.fr) has been vandalized and even though I found some informations on the mediawiki site, I can't really figure out how to resolve quickly this problem and how to protect our wiki to avoid such a problem again. 1) Is there any quick way to recover the pages that have been erase without having to go on the history and recover the content article after article ? 2) I guess to avoid this problem, the best way would be to move our wiki to version 1.5, is that right and is there some extra things to do on the default install to protect it ? 3) Is there a place where I can post (if this can help) the IP that vandalized our wiki ? Thank you for your precious help Cyril _______________________________________________ MediaWiki-l mailing list MediaWiki-l(a)Wikimedia.org http://mail.wikipedia.org/mailman/listinfo/mediawiki-l 'a star solutions' disclaimer The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential and/or privileged material. If you are not the intended recipient of this message you are hereby notified that any use, review, retransmission, dissemination, distribution, reproduction or any action taken in reliance upon this message is prohibited. If you received this in error, please contact the sender and delete the material from any computer. Any views expressed in this message are those of the individual sender and may not necessarily reflect the views of the company. We believe that this communication is free from viruses and other potentially dangerous programmes, but the recipient opens this communication at their own risk. We assume no responsibility for any loss or damage arising from the receipt or use of this communication

On Oct 23, 2005, at 12:40 AM, Arthur Guy wrote: :`( well, knowing that I realized a bit too late what happened, there's no more useful backup that can be used. Oh yes, good idea, gonna check that out That's true, I have been trying to make some search about the IP's but it doesn't give much informations unfortunately.

Cyril Pavillard: As has been pointed out, you're running a MediaWiki version that has a bug which can lead to database corruption. Upgrade to version 1.3.17, 1.4.11 or 1.5.0 ASAP to avoid serious and permanent loss of data. The 1.5.0 upgrade process is the most dangerous of all these, so make sure you have backups. Until you do so, I suggest locking the database - if you have the necessary permissions, you should be able to do this using the page Special:Lockdb. You can also manually lock it by creating the file specified in $wgReadOnlyFile in your DefaultSettings.php. 1.5 has many security measures (rate limiting, SORBS proxy blacklist, support for spam blacklist extension etc.). Until you figure out which method is the most effective, you may want to simply disable editing by anonymous users. In 1.5, this is done with $wgGroupPermissions['*']['edit']=false; in LocalSettings.php. This will not help against a determined attacker, but may be enough to deter drive by vandalbots or spambots for some time. HTH, Erik

Reading the named page several times, I am not shure, if I undestood als things well: 1. Where do I find the "Spam Blacklist extension"? 2. How do I install or activate it? Regards Karl Kirst -------------------------------------- post(a)karl-kirst.de www.karl-kirst.de / www.schule-und-internet.de Mitarbeit am ZUM-Wiki: www.zum.de/wiki --------------------------------------

Thanks for your helpful advise. (I've been some days in hospital and couldn't answer before.) Regards Karl Kirst