Seems to be a board exploit. (Which has a fix, but the PhpBB guys never emailed their list about the exploit nor the update!)
I do have daily backups. They can't do the backups though, as it seems (thanks to Opti who can find info on anything) that (according to a post on a board that was found), if they restore, the worm reexecutes all over again. Apparently they have to find the worm on the server first. Then do the restore. No time telling how long it will take. But CyberWurx guys are good.
Appreciate the offer of assistance. And will keep it in mind. Not much can be done at the moment except a search and destroy mission by the server guys for the worm though.
|