Need Help ASAP

[BHClanGaming.com™]

Just got to my forums.  Well all admins are gone. I've been hacked.  I don't know what to do.. Any ideas people?  Thanks so much! 


>

[BHClanGaming.com™]

so is there like a way I can add myself as an admin manually through like mysql or php files?  all information at this time is very much appreciated. 

[BHClanGaming.com™]

nobody in this forum can help me???  Wow.. anyone at all.. please kthnxbai

[elfishtroll]

Just got to my forums.  Well all admins are gone. I've been hacked.  I don't know what to do.. Any ideas people?  Thanks so much! 


>

determine your IP address:
http://whatsmyipaddress.com

next  thing, upload a "I'm closed for busines right now htaccess file."  which denies to ALL (except your IP)

next connect to your website and download all your 'ish (to go through it and find where they came in)

you should be able to back up your database from the CPANEL or whatever interface your host provides (if your database still exists )

backup your  files
check the file backup to see if it has files in it

check the database backup to make sure it is not an empty file.

backup your logs (they may be separately accessible than data/files)

DELETE EVERYTHING




Check to make sure there is no CRON scheduled process setup (check with host if not sure)


FORENSICS

Go through your logs

If you are using an old outdated version of SMF of whatever other software, kick self then go through logs again.

More likely as not, your host wont be of any help, unless you are with 1and1 in which case they will suspend your account or GoDaddy in which case they would give you a number to call that never gets answered (in English)

--Rebuild the site by redownloading the SMF and Mods etc from the original sites.







* Closed for rebuilding HTACCESS file
##
ErrorDocument 403 "<b>Closed for upgrading...please check back at 2pm
  order deny,allow
## of course you would put your IP address here
allow from  my.ip.address
deny  from all   


Afterward you would remove that .HTACCESS file and replace it with a proper one


BTW what is your host and software versions?