ExpressionEngine® Answers is a question and answer site for administrators, end users, developers and designers for ExpressionEngine® CMS. It only takes a minute to sign up.
Sign up to join this community
The index.php file in root has been injected with code. I do not know what this code means, but this is obviously not good. This is the first time this happens in all the years I work with EE. (BTW, the server that this build runs on is not my choice.)
My questions:
1) what do I tell the client? Does he have to move server (ISP?)
2) What do I do, should I reinstall EE completely?
Hope for an answer here, thanks.
The first thing to do is remove the code but you should also look to see there is anything else that has been touched. Reinstalling completely may be unnecessary but it won't do any harm.
If you store any personal information of users you should also determine whether or not this has been taken and your client needs to decide whether or not to inform them of the breach.
But it is pointless fixing anything unless you find out how the code was injected. In all my time working with EE I have only seen a few hacked sites. But they all tend to be on shared servers and the attack vector was another popular CMS hosted on the same server.
The injected code might give you a clue as to where the attack came from. Do some Google research on that as it might help determine your next steps.
As far as your client goes, be up front. This kind of thing happens and anyone that thinks any site is 100% secure is fooling themselves. The real issue is how you deal with it now. Be open and thorough. Try to find out how it happened and take steps to prevent it happening again.
I agree with @foamcow's answer.
Also, change your SFTP and MySQL passwords and look at .htaccess in case they injected some redirects.
