XF 1.5 My site has been hacked

ibaker

Well-known member
Both a user and I experienced a page come up when first going to my site saying that it had been hacked. It was a dark screen with 1's and 0's falling down on both the left and right sides of the page and text scrolling across the screen saying things like Database downloaded, Database deleted etc.

A minute later it was ok and everything working properly on the site.

I did do a complete backup just an hour before by exporting the database and compressing all files into a zip and downloaded that. But note that ius a 800mb database and 4gb of files

One thing I noticed when looking through the site's files the index.php has today's date on it compared to the backup I did plus the contents of that file in the backup shows 8 lines in groups of 2 with a blank line in between them but the current index.php file on my server has many line spaces in between the 8 individual lines.

I have my own dedicated server with firewall, whm, cpanel etc and the only other software on the server is CS-Cart.

What do I do now?
 
Top