Site is being hacked as we speak

[Kimmie]

HELPPPPPPPPPPPPPPPPPPPPPPPPPPP!!!!!!!!!!!!!!

[margarett]

Now that is a good support request, isn't it?

Honestly, do you think we can do anything to help you with the topic you created?
...

[Arantor]

1) How do you know it is being hacked?

2) If it is being hacked, modify Settings.php, where it says $maintenance = 0 and change that to $maintenance = 2; which will lock down the forum, followed by making all the files permissions of 000 to disable them even being read by Apache.

[Kimmie]

Sorry I AM FRANTIC..lol

They took over my admin account, removed my other admins changed the name I had to "admin and changed my password

[Kimmie]

Working the setting file thing  now

[Kimmie]

AWESOME. I now have a white page that says Maintenance In Progress. Please be patient Estimated Down Time 1-2 Hours


What can I do now?

[ApplianceJunk]

Maybe you will find something here helpful.

http://wiki.simplemachines.org/smf/Hacking_-_I_think_I_have_been_hacked

[Kimmie]

ok I will go through that and see if it helps me get this sorted. Thanks.

[Kindred]

you got that white screen with text because you put the forum into maintenance mode lockdown.

Did you set the file permissions? 

How do you know you were hacked?

Do you have any server logs (check with your host if you don't know what those are)

[Kimmie]

I though the said it would change them all to 000 automatically

Because the person told me they were going to do it and that they already had my DB (not sure what they meant). They have taken over my account, changed not only my PW but the name, email., everything,

I can still get into CPanel. Is that where the log is you need?

[Kimmie]

Well that did't work.. now I have this


http://patriotgames2.info/index.php?action=forum

[Kimmie]

I will gladly give one of you my info if you can help me get this stopped

[kat]

If that was my site, I'd get onto my host PDQ. I'd also change all of my passwords and restore my latest backup.

[ApplianceJunk]

I agree with K@.
You do have backups, correct?

[Kimmie]

I already sent them a ticket but they are a few hours ahead of me so I have no idea when they will even get back to me. I changed my cpanel password but if they can do that to the forum main page, doesn't that mean they already have it?

[Kimmie]

Yes I have backups

[Kimmie]

It has been so long since I have restored one, I don't even know where to start.

[kat]

No point in even thinking about restoring, until you can stop them rehacking you.

Get onto your host, first.

When you get to the point of restoring, you can think about CPanel>Files>Backups and restoring.

[Kindred]

Also, your Cpanel password and access should have nothign at all to do with your smf admin access....

unless you used the same username and password for both? (if so, naughty... don't do that)

[Sir Osis of Liver]

Who is your host?