Changes ALL Database Usernames & Passwords then reset in config, remove old user from all DB's etc.
Check for modified files, compare timestamps etc.
IF you can access admincp check your template system for edits, revert all modified templates.
Check for shell files, .php, any new very large image files, anything with a odd name as sometimes it's apparent and sometimes it's not, depends on the hacker per say.
Check for oddly names modifications or plugins, recently a plugin was the culprit for me on a clients site.
The most important this is restoring from a backup, unless you know what to look for you could miss something so restoring then figuring out how you were compromised should be your number one priority otherwise they'll simply repeat the process .
04-03-2011, 05:54 PM
.
Threaded Mode