XF 1.4 VPS Server Compromised: Need Help Restoring Files

[Phillip]

Our server was attacked and most of the files modified were XenForo files. I've changed all passwords and restored clean versions of most of the default XenForo files but still need to upload or recreate these files.

data/index.php
internal_data/index.php
internal_data/install-lock.php

Can anyone assist with the proper steps for recreating these? We're running 1.4.7 with all patches installed. Thanks in advance!

 

[Paul B]

There is no index.php in /data or /internal_data.
There are index.html files but they are blank.

For the install-lock file, just create a new file with these contents:

<?php header('Location: ../index.php'); /* Installed: Tue, 23 Jan 18 12:00:00 +0000 */

 

[Phillip]

Thank you Brogan for the help. We're back up.