wow, site is borked!!
Been gone all day getting my wisdom teeth taken out, so I have been out for most of the day. When I get around to checking the site at 1am its ka-screwed. Seems no one can access the forums even now, they disabled the module. I can still access it because I am logged in as admin. (something handy for the other people with admin access to CKA to take note)
They really messed things up this time, they have deleted a bunch of stuff out of the database, like all the stuff from the "Content" section, all the sites blocks info and site configuration settings. For example the title of the site is visible changed to "
[email protected]".
They also created an index.html which i assume they wanted to load when someone came to the site, but I have index.php take priority do it didn't work.
They also re-wrote link.php with there hacker info, this is the file that is used to forword someone to one of the external news links form the front-page.
I will have to take a closer look at this file and see id they somehow got in through there. But one again I do not know how they managed to do this.
I scanned for all modified files on Aug 18, all there was, was some new funny pics and babe photos added to the gallery, a new avatar, and the index.htm and link.php files written.
So I am working now to try and piece the database back together, I make a database backup everynight, but i don't want to just restore last nights backup, we'd loose all the posts made today. So i wll try and just piece together the parts that were effected.