[TYPO3-UG Denmark] TYPO3 hacked part 2

[Henrik J. Koch]

This mail looks like a previous sent one - but in this i clarify something
more.


Hello TYPOs my site has been hacked. I searched for files changed 19.oktober
because i could see that the hacker did place a index.html file with the
content "Hacked By Frosty". But even though this still is a problem. I only
get the text "Hacked By Frosty" when looking at my page:
"koch-engineering.com"
 
Please help me to tell me where to look and how to get rid of this "Hacked
By Frosty".

Where can this hacher place something that I cant find. I copied the whole
set of pages to my local computer and did a files text search for the text
string. I can´t se it - so in some way he must have placed this string in
the database or maybe he did a redirection of a page. 

After replacing these index.html files from many places i'm now able to go
to the admin page and from here i can see that my database looks intact. I
can see the contents of my subpages.

Where can I start ?
 
I will be very happy to hear from one of you.


Please help !

best regards
Henrik