iSKORPiTX hack

[wicker]

Last weekend I was hit by iSKORPiTX hacker. All my PS folders were infected by its index* files.

I did delete my PS installation located in root/shop (database was not there so no problem with delete)

The I copied a backup I had in my local PC again to root/shop (same structure of folders). At that moment my directory of PS looked exactly as it did before the hack.

But something did go wrong: in BO I indicate that my PS directory is "/shop/" (with a slash at the end) but when I go to the shop's address I can see that it is unable to load the css and style sheets; also links are broken and do not work (now in plain html)

It seems there is a bigger problem there: my administration directory is located in root/shop/shopadmin
As I indicated that PS directory is "/shop/" when I move arround the BO the links appear as so:

http://mydomain.com/shop/shop/dmin/...

notice that instead of pointing to shopadmin it points at shop/dmin

An "a" is changed by a "/" therefore I can't move arround BO properly. The only solution to move arround ok is to remove "/" from my PS Directory in settings.inc.php but if I do so, then the FO does not work ok...

Very messy!

Anyone of you has an idea of what the problem would be? Thanks in advance

Pau