My database has been hacked

Corporal Joined: Jul 28, 2003 Posts: 59

Previously i was running nuke 6.5 and i was hacked tonight so i decided to upgrade to 7.5 no biggie but i found the damage was done not to my main website but to my database go to www.abcuo.com/index.php and look at what he did. Where do i look to clean out his crap and restore it to its original pristine condition without wiping the db clean and starting over. In theory there should be 4 different copies of the database because all the admins should have been backing up but my backup is a month old and the others have not been doing any db dumps at all. On a website with 18k hits a day I need to loose as little as possible.

Corporal Joined: Jul 28, 2003 Posts: 59

UPDATE

i have removed the offending database entries and have somewhat restored the website to its formerglory. the only problem is now the board is defaulting to its original install state ie brand new and ignoring several months worth ofposts. how do i remedy this issue?

Posted: Sat Nov 20, 2004 10:24 am

its hard to say .. I dont know what you deleted to remove the offending database entries also dont know what was done to your site .. Sounds like they added a Message on your index page which could have been deleted from your admin panel .. Sounds like they used an old exploit to inject a god admin in your nuke authors table and was able to acess your admin page and post thru your messages module... Restoring the database from the most recent is about the best you can do if you dit not back up the databse before trying to attempt cleaning up the mess...

hope you get it worked out .. 9 times out of 10 most hacks involve a new admin being made that would be your first place to look for the intruder then open your admin page and open the messages module there would usualy be the offending post or your stories module

good luck