HELP MY FORUM GOT HACKED

[Pat]

OKAY OKAY OKAY, My two top forum designers/coders are trying to get rid of the hacker. This is the thing, The hacker made an EXACT clone of the website "ninjascape.110mb.net" So if you click on the topic, it takes you directly to that site. It looks liek you just got logged out and you have to log back in. Then some of our admins got tricked and entered their usernames and passwords and then the hacker retrieved it. They went into the panel then demoted me and all the forum admins. Then he/she deleted all our 40000 worth of posts and then demoted everyone. FFS AND WE LOST OuR DOMAIN .NET SOMEONE HELP

I KNOW HE CANT DEMOTE THE FOUNDER, BUT RIGHT NOW HES AWAY FOR TWO DAYS SO I CAN'T DO ANYTHING. IM ALSO SCARED TO GET ON THE SITE AS HE CAN GET MY IP THEN DDOS ME, HE HAS ALREADY DONE IT ONCE

Code:

<DIV style="height:1px"></DIV><UL id="navstrip" class="clearfix"><LI class="begin"><A href="http://www.ninja-scape.net/forum.htm">NinjaScape</A></LI></UL><FORM action="login.php" method="post" name="form_login" class="ipbform columned"><DIV class="borderwrap"><DIV class="maintitle clearfix"><H3>Log in</H3></DIV><DIV class="subtitle"><P>Please enter your username and password to log in.</P></DIV><DIV class="box-content login"><DIV class="errorwrap"><H4>Warning !</H4><P>You are not logged in.<BR>Would you like to register ? <A href="http://www.ninja-scape.net/profile.forum?mode=register" class="button2">Register</A></P><P><A href="http://www.ninja-scape.net/profile.forum?mode=sendpassword">I forgot my password</A></P></DIV><FIELDSET class="formcolumn1"><LEGEND>Log in</LEGEND><DIV class="row clearfix"><LABEL for="username">Username:</LABEL><INPUT type="text" tabindex="1" name="username" id="username" size="25" maxlength="40" value=""></DIV><DIV class="row clearfix"><LABEL for="password">Password:</LABEL><INPUT type="password" tabindex="2" id="password" name="password" size="25" maxlength="25"></DIV></FIELDSET><FIELDSET class="formcolumn2"><LEGEND>Options</LEGEND><INPUT type="checkbox" name="autologin" id="autologin" tabindex="4" class="checkbox" checked="checked"><LABEL for="autologin">Log me on automatically at each visit</LABEL></FIELDSET><DIV class="clearfix"></DIV><FIELDSET class="formbuttonrow center"><INPUT type="hidden" name="redirect" value=""><INPUT type="hidden" name="query" value=""><INPUT type="submit" name="login" tabindex="6" value="Log in" class="button"></FIELDSET></DIV></DIV></FORM><SCRIPT type="text/javascript">//<![CDATA[
if(document.forms['form_login'].elements['username'].value == ''){document.forms['form_login'].elements['username'].focus();}else{document.forms['form_login'].elements['password'].focus();}//]]></SCRIPT></DIV>

THAT IS THE CODE THEY USED TO GRAB OUR ADMINS PASSWORD. WE MANAGED TO GET THAT OUT OF THE FORUM BEFORE HE DEMOTED ALL OUR ADMINS TO MEMBER.

[Pat]

PLEASE... WE SPENT 40 DOLLARS WORTH OF DONATIONS ON THE DOMAIN.

[Pat]

please

[Caihlem]

HEY!

I can understand your frustration, but take a breather. Your posts were posted at 4, 5 and 6 o'clock in France, which means most of us were in bed, so difficult for us to answer.

First of all, I'd advise to remove to code he used. you're giving free information to eventual new hackers.

Secondly, this isn't a problem. Once the founder comes back, all he'll need to do is go into the Utils and restore to how it was before the attack. He'll also need to re-Admin everyone, but that's a detail. You should, normally, get back your users and posts. For the rest, I'd advise you contact Typlo calmly and ask if he can help you in any extra way, there's o guarantee he can though

P.S: Keep breathing