Tweet
Well, looks like we have been hacked. I recently moved my site to a new host because we were having issues (speed, etc) and it might have been due to a hack. I've spent the last several hours looking into this.
Here is the situation. I cannot access the forum and while I can get to the adminpc directory, once I log on I am redirected directly to the pagesinxt.com page. Given that I can see the logon page for the admin panel and an html file I use as a temp file I do not think I have an issue with the .htaccess or the server itself (I checked this as well as the plesk conf file). So while I am trying to turn off add ons by using
define('DISABLE_HOOKS', true);
in the config.php file, I think this is a little like shutting the gate once the cow has run away. I believe the db is now the issue and I've been searching in the template table and others with little result.
I've replaced all the forum files with new copies from the zip file.
So far I've searched for base64 in the template database (none) and tried to look for "pagesinxt" across the db and on all the forum files (grep). Nada.
So I truncated the template table and ran the upgrade script for 4.12 patch 1 - hoping to thus get rid of any issue with the template files. Not good. That didn't help and I need to restore the template table now.
Where can this be hiding?
Here is the situation. I cannot access the forum and while I can get to the adminpc directory, once I log on I am redirected directly to the pagesinxt.com page. Given that I can see the logon page for the admin panel and an html file I use as a temp file I do not think I have an issue with the .htaccess or the server itself (I checked this as well as the plesk conf file). So while I am trying to turn off add ons by using
define('DISABLE_HOOKS', true);
in the config.php file, I think this is a little like shutting the gate once the cow has run away. I believe the db is now the issue and I've been searching in the template table and others with little result.
I've replaced all the forum files with new copies from the zip file.
So far I've searched for base64 in the template database (none) and tried to look for "pagesinxt" across the db and on all the forum files (grep). Nada.
So I truncated the template table and ran the upgrade script for 4.12 patch 1 - hoping to thus get rid of any issue with the template files. Not good. That didn't help and I need to restore the template table now.
Where can this be hiding?
Comment