TURK GRUP Attack Help

[daemonkin]

Hi guys,

Recently a client's SMF install got hacked by Turk Grup and I have been having a nightmare ever since.

The site was version 2.0.1.

When I was informed of the hack I renamed the public_html folder to _public_html and created a new directory with a fresh install and then moved across the database again.

Thought it was sorted but client notified me that no content of posts was appearing. I feared that Turk had deleted all content but when I checked the database last night all the content was still in there. It is just not showing.

Is this something anyone has had experience with before? Is there a simple checkbox in the admin to 'turn off' content?

Thanks for any info,

D.

[Oldiesmann]

You need to update the database info for the new install to point to the old database. You can do this from the admin center (Admin -> Configuration -> Server Settings -> Database and Paths).

[sambling]

I had the exact same problem except I didn't have a backup. I got the repair settings.php file and reinstalled the (deleting all the files). I also deleted as many sql tables as I dared. AND after hours IT WORKED!