Quick question, I've turned my forums off in the AdminCP while I've been cleaning up after the hack. However when I go to my site I can see that there are several guests who appear to be accessing various parts of my forums. But when I try to access my site as a guest, I receive the message that the forums are off line, and I can't access anything. Has anyone else notice this?

They should have he little lock icon next to their usernames, if they are attempting to view the site while it is closed.

That is a legitimate file.

It created when you have a database error - to track the time and error code (1379011524,1146). This is used to limit the number of database fail e-mails sent.

Can you recommend a good Windows compare tool that would compare all the files in both forum root directories and highllight the differences?

I've used winmerge before, its pretty good...

http://alternativeto.net/software/me...atform=windows

Has anyone recovered from this without reverting to an earlier database ??

I have securi saying all files are clean.. I have the install folder gone.. Of course removed the admins and stuff.. But I am still being taken out..

I would compare the db and files (corrupted) to a known clean set before hack. At least you could determine what files are modified, which you could eliminate...

If you are running a portal check the index.php file, when mine was hacked this was re written.

In fact you need to check the index.php file anyway.

also look for any txt files in the root, I found a couple, also look for a file called mail.php, this was re-writing the index.php file even after I'd uploaded a clean version

how do you check the logs? I upgraded to 4.2.1 and it is through cms

--------------- Added [DATE]1380912104[/DATE] at [TIME]1380912104[/TIME] ---------------

Okay I got it ! They messed up the forum home template. I replace with the older style.