XF 2.2 Lost all formatting/layout after hacking. How to restore?

[kdoney]

Our woodworking forum (v2.2.9) was hacked this weekend. The hosting company did their cleaning and everything is fine, no data lost. The only problem is that Xenforo now displays without any HTML formatting. I'm taking a guess as to what is causing the display (see attached file).

The admin interface appears fully functional but everything is stripped of formatting and left justified. The front-end looks the same way.

I'm hoping someone has seen this before and can point me in the right direction (i.e., files, templates). I am a very new Xenforo admin so I'm not familiar with how it handles layout/etc.

Any suggestions would be appreciated.

Keith

 

[beerForo]

Rebuild master data work?

This can be done at /install

 

[jeb35]

Disable all addons and see if that fixes it too.

 

[TPerry]

Rebuild master data work?

This can be done at /install

Recently upgraded to PHP 8.1 on my VPS... and had this exact thing happen. Rebuilding the master data resolved it for me, so it's definitely worth the attempt.

 

[kdoney]

I rebuilt the master data but the display problems persist. I have also disabled all addons without any improvement. Thanks for the suggestions.

 

[Jeremy P]

It might be worth downloading the upgrade package manually and re-uploading all the files. Your CSS is throwing a 403 error.

 

[kdoney]

Problem was solved eventually. The hacker had dropped a malicious .htaccess file in the root directory. It essentially denied access to the files needed to render things properly. Once that was removed everything returned to normal.

 

[Ricsca]

I would install a new 2.2.13 forum on a subdirectory eg /forum2 then migrate the old forum to forum2 and delete all files in the root.
Then I would install a new forum in the root and migrate from forum2.
This way you are sure that you no longer have any hidden malicious files...

 

[Mr Lucky]

The hosting company did their cleaning and everything is fine,

Obviously they didn't do a very good job otherwise you wouldn't have this:

Problem was solved eventually. The hacker had dropped a malicious .htaccess file in the root directory.