We've Been Hacked! Help!

[IntellectToday]

<a href="http://www.intellecttoday.com" target="_blank">http://www.intellecttoday.com</a>

We've been hacked. I don't know how, I don't know why, but it has happened.

Now the question is - how do I reverse it?

[markbolyard]

Do you have nightly backups of your forum's database? Files?

PM me, and I'll see if I can help you out.

--------------- Added [DATE]1209677005[/DATE] at [TIME]1209677005[/TIME] ---------------

Got your PM...

Replied. Can you log into your admincp?

[Boofo]

All I see is a white page. Did you add a hack recently?

[markbolyard]

Go to showthread.php. I think he removed the index.php or added a index.html to hide it.

[Boofo]

OK,I see it now. Thanks, Mark.

You need to disable the plug-in system in the config.php and see if that fixes it and then check your added hacks one by one to see which one is causing it.

[markbolyard]

I've got some things to do but will be back later this evening should you need some help with this. Good luck getting it back. Hopfully it's something monor, but worse case, restore your complete backup, perform a upgrade from RC4 to Gold, and verify your hacks installed are secure.

[toonysnn]

Looks like you were hacked..again. I was looking at the traffic over night (Cause I had nothing to do. ).

I suggest you check with your host, see what's going on, and if needed, patch it.

[SmileyR]

yea looks like it but it appears all they did was edit the templates u can fix that by reverrting or i think by DB restoration just after thats done change ur CPanel pass, admin pass, and ftp if not linked to ur cpanel... and be more careful

[Big Boss]

It's always a good idea to make a weekly backup, though a daily backup is even better.

[IntellectToday]

Well, I've learned quite a bit from this experience.

We were able to restore the site - twice! And I now make nightly backups, and my host does the same.

I would like to thank everyone who helped out!