HELP! site hacked, templates messed up

A few days ago my website was hacked.

The hacker deleted my languagefiles and replaced them with some stupid textfiles.

My site was completely messed up, languagefiles were missing, designinc file messed up, etc

After restoring a backup of the languagefiles I'm up and running again, but I still have some errors....

Everything works except some features:

- When a member creates a poll, he can't create extra answers (the green '+' and red '-' button are missing).

- When a member want to answer a email, there is no sendbutton at the bottom and the whole email-layout is messed up.

Maybe there are more errors, but didn't find them yet.

I have several templates installed and all the templates are having the same problems.

The problems are in IE6-7-8, Google Chrome, Firefox and Safari.

Can someone help me with this?

Do I have to reinstall some files (and which files then) or...?

And my second question...

How can I protect my site even more?

All my files are CHMOD to 755 except the ones who need 777

Thanks for a quick answer!!!!!!!!!!!!!!!!!!!

If they uploaded files then they got file access.  They could have hacked your ftp password (change it to be something hard, use a generator) or if you are on a shared server then they could have come from anywhere on the server.  The only thing you can do is to keep good backups.  Also scan your computer to ensure you don't have a trojan on your computer.

As for the template issues, try to reinstall the /templates/base/   directory in its fullest.  The uni template and most custom templates will draw the basic rules from the base folder, including pictures, and see if that solves your issues.

I uploaded a backup of the complete basefolder, but that didn't solve the problems unfortunately.

Anyone another idea?????

Stupid question but did you clear out all your caches and tmp file?

I agree with maurice baby...

Obviously someone had file access. For that very reason, you have no idea what changes were applied. If it were me, I would do a fresh install, reinstall the mods. then the data and I wouldn't even mess with trying to fix the custom templates. I would install new copies after you get the rest of it up and running.

FIRST THING though before you do any of that is to determine exactly how they got the access and plug it up. It would suck to go through what's sure to be many hours of fixing to only have it happen again. If it turns out your server (shared) isn't safe, I'd be moving to another host. Once at the new host, you need to make sure you change all your access passwords on a regular basis to further beef up your protection processes..

SkyForum is right about tracking down the hole first and doing a reinstall.

The person could have implanted malicious code in the php files that you won't be able to readily track down.  A fresh install will eliminate the possibility of that problem.  The other thing I would be concerned is if they could get into your sql they could have implanted malicious code in fields.  I'm not sure how you would track that down but it is something to be aware.

If they have removed your language files, then I think this is a server hack. So look at your server logs to find out how they have done that.

I contacted my provider.

maybe they can restore a total backup from the day before the problems started.

thanks for all the answers!!!!!!!!

really appreciate that!

There's no backup available anymore....

So I think the only option is a fresh install.

But... can someone give some advise how to do a fresh install?

I still have the upgrade from 6.1 to 7.0 in mind

What steps do I have to take to secure all my profiles and media?

And how do I import my database again?

I did a reinstall before on 6.1 and that was a complete disaster.

So can someone give some advide?

Please wait before 7.0.1 is coming!! 7.0.1 is more protect

But is that enough?

Just upgrade to 7.0.1 then?

I mean... is that the same like a fresh install to solve my problems?

It looks so. 
If you need to install it fresh, then I say wait for the new version. 
But otherways you can install 7.0 fresh and not install mods or modified anything and you can upgrade to 7.0.1 

but how do I a fresh install?

just delete all the files from the server and start all over again?

how does I get all my profiles and media back then?

I remember I did a fresh install on 6.1 before and imported my database.

I lost all my media and profilephotos.

They were there but not visible anymore.

And I can't email all 700 members to create a profile again.

It would appear that you've allowed yourself to fall into one hell of a hole. You can either do a fresh installation, which means starting from scratch, or, you can re-install the script, and then switch your current database in favour of your older one, all while re-adding the needed media files to their respected directories. The issue is, we don't know how much damage was actually done, and whether or not anything in the database was compromised. This is a good example as to why you should always have a backup available, in case something such as this occurs.

I have a backup of my files, like the templates/base etc.

but this doesnt solve the problem

but I will try first with a copy of my database en a fresh install on a subdomain

if you still have your db and files on server chances are you could save/import some of your old stuff to the new install (it's time consuming..)

As expected... it didn't work.

This is what I did:

- made a backup of my database

- created a new database and imported the backup of the old one (now they are similar)

- created a new subdomain and did a fresh install (my pld site is still running on another subdomain)

- setup the install and pointed to the new database

But the database files were not imported in the new site.

Don't see any profiles or media.

What went wrong???

anyone experience with fresh install and importing an existing database?

Importing an exsisting DB is easy. Go to your /Cpanel and click on PhpMyAdmin icon...then click the import button

Have your host re-install a fresh copy for u

Hi there, so was the dolphin version that was hacked version 6.1 or 7 or 7.0.1?

I'm pretty sure from reading the rest of the topic it was 6.1 but wanted to make sure.

Beceause I got hacked and have spent the last 3 months upgrading to 7 so I wont get hacked again.

Cheers

bro,

if you spent three months upgrading to Dolphin 7, may i ask what is taking three months?

Regards,

DosDawg