I've been hacked!

[KDLmedia]

Last month, somebody hacked into my site and replaced my homepage and a few others with something related to Palestine. How they got in is beyond me, but I was able to replace those templates and changed my admin password.

A few days ago, I noticed that several of my links are missing. As far as I can tell, it is only the folks that have paid for links on the homepage. And to top it off, my admin password has been changed again.

I'm going to change it back and try to repair the damage, but can anyone offer suggestions as to why this keeps happening and something I can do to track down and/or prevent this from happening again?

Is there any type of log of admin activity that I can look for?

[KDLmedia]

Incidentally, I'm using 3.0

[aladdin]

Several posting were made about this problem, please read them for more details.
1) Remove the tools directory from your public directory
2) Delete the install script
3) Make sure that the hacker did not create a new admin accout, look in user tabe.

[KDLmedia]

Thank you for your response. I was able to locate the threads that you mentioned and apparently I was foolish enough to not remove the Tools directory also. At least I know now how he got in and can prevent further attempts. Thanks!

[tjoerg]

Hello,

every single access to your website is logged by your server. Hence the hacker too! Try to get your logfiles for this time period.

They give you some more detailed information (ip, time, files...) about the hacker. Try to trace the ip and inform you host provider too!

Make sure that you have read the security related topics in Indexu manual!

Joerg