Hello again,
Well, if you deleted the compromised Moodle files without backing them up, it will be difficult to sort out what happened. If you still have your config.php, could you please post it here ? (be sure to remove both lines containing your DB username and password though) It could help us know what kind of an attack type this was.
By the way, it is correct for the moodledata folder not to be under the htdocs directory.
As to look for modifications, I would look at moodle/help.php (the original hacked-moodle one), because it seems strange someone would POST to it (according to your Apache log file).
Regarding the $_POST section of your hacked config.php file, I would suggest to look for any line in your Apache logs mentioning HTTP access to this config.php file (which I think should never be called directly). Something like this in Bash should do it :
cat /path/to/your/apache.access.log | grep "config.php" >> somefile.log.txt
repeat this for each apache access log file.
To help you further, I would need :
- the incriminated moodle/config.php file
- the possibly compromised moodle/help.php file
- the somefile.log.txt your would juste have built
I have to stress that the only reliable recover solution would be (as explained in the
MoodleDocs page I linked in my last post, and summarized here) to :
- unplug the network cable
- identify the time of hacking and possibly the hacking method as well
- rebuild the server from scratch using different passwords
- take into account the hacking method if the hacking was due to an incorrect server configuration, and correct the server configuration if necessary
- recover from last backup before hack time
- upgrade to latest Moodle stable version
- plug network cable again
But if you wish to answer my three points above (Apache logs, and possibly compromised files), we might be able to resolve point 2, which would help us know (to answer your question) if the steps taken were sufficient or not.
Regards.
