IMMEDIATE HELP needed (like, right NOW) restoring hacked site 3/8/12 6:45pm
My client's site is down and needs to be back up right away. (Yesterday a targeted email went out to 15000 people referring to an upcoming event, this down time is probably costing her thousands.)
This happened a couple of weeks back but the guy who helped me restore it is out of town until next week.
What I've done so far... deleted the entire site, re-installed the original version of C5 that I installed last year 18.104.22.168. I restored the database to a version that was backed up about 5.5 days ago, (Saturday, when I last logged into the site & it was still good.) I went to the page to enter the database name & it says that c5 requires an empty database to install in. So, I've exported the database. Thought I'd delete it and then create a new one with the same exact name, install c5, then import into the database. However, whenever I create a new database I have to use a different name, it won't let me create one with the same name.
I don't know what else to do.
Can someone help.
I can pay.
define('PASSWORD_SALT', 'long string of characters');
Going from memory if that file is in place and defines the DB connection then C5 will assume it is already installed.
You might also have issues with themes, templates and customizations that are not part of the default C5 installation as well as the contents of the /files directory for uploaded images etc... this depends how much customization you have done. Do you have a good backup of the files that make up the sites?
Above all, if you restore the site perfectly it has a good chance of being hacked again using the same method... if this was a poorly chosen admin password that is easy to fix but there are many other ways it could have happened, especially if you had custom PHP code on the site that could have been exploited.
> This happened a couple of weeks back
This definitely sounds like there is a security hole you need to fix, rather than just getting the site restored even if that is your short-term goal.
If restoring site.php doesn't work, please post that here.
I assume you are on Dreamhost. It appears that a large number of their shared hosts have been rooted. So, this will keep happening until they fix the vulnerability, even if you get the site back up today. You should probably create a static 'down for maintenance' page with your essential event details.
Unfortunately the clean back-up of the site is with my developer, who is out of town. I was able to recreate the site.php file last night, which worked.
Next step, getting all of the addons, etc. in place, along with their customization. Then I was going to update the site to the most current version.
We were using wordpress for an event registration plugin, which is where I'm thinking the breech may have been.
But xaritas is correct, I'm on dreamhost. Do you recommend that I switch hosts?
Meanwhile, I'm going to take your suggestion, put up a page and wait for my developer with the clean code.
p.s. I'm monitoring this post but it doesn't seem to be sending me emails.
If you don't want to go through the hassle of moving, I'm 99% certain that if you upgrade your service to VPS, you won't have these problems. They will do the migration and everything for you.
Also, just my opinion, but you should work with your dev to have your website in version control, and then have your dev teach you how to use it.