Calendar page hacked

Permalink
Our calendar was hacked and they added additional coding on that page. I cannot figure out how to open the calendar to take out the code. Here is the webpage:

http://www.troop101pomona.org/calendar/calendar.php...

I can see the coding added by seeing the page attributes with my web browser. However, I cannot seem to find the actual place to edit the calendar page with the dashboard page. I've tried going to the calendar page to find a place to login to edit the page, but I cannot find any login button. Is there a way to remove the added coding so that I can return the page to "normal"?

 
ScottSandbakken replied on at Permalink Reply
ScottSandbakken
Honestly, the hacker probably put code in your database. Your best bet is to restore from a backup.

However, since swapping out code is pretty easy, I would start by downloading a fresh copy of your calendar add on, deleting the existing files for that package from your [root]/packages folder, and uploading the fresh copy.

If that doesn't work, you could try downloading a copy of concrete5 fromhttp://www.concrete5.org/developers/downloads/... (Make sure it is the same version as you current site).

Then, FTP into your site. Change [root]/concrete to [root]/concrete_old. Upload the concrete folder and the index.php file from the zip file you downloaded to your site. This will restore all your core files.

Note: If you have upgrading since installing concret5, you will need to replace the most current folder in [root]/updates.

If none of this works and you don't have a database backup, you may need to go through the tables manually to remove the code.