[Hornstar]

Originally Posted by Quarterbore

...try looking for "REFRESH" or "HTTP-EQUIV"

I know you don't know me but if you would like help I would be glad to try to help but the only I could do that is to get access to your database. I am very curious how they did this for the tool I am coding hence my interest.

EDIT: you are searching like this, right:

%refresh%
%http-equiv%
%index4_files%

I ask as I get hits for the first two and my site is not hacked. But there are not may of them so you can look at them to find the cause.

Also search for this if you are not finding anything...

%base64%

I searched my database for %base64% and found quite a fair few hits but can not determine which are legit or not.

My site got hacked last week and I found a different method to get my templates showing up instead of the hacked version, however i still have a couple of the hacked templates up as I have not had time to change those just yet.

Any idea what table name, or what kind of code i should be looking for more exactly?