Hi. I have drupal installation on my server. I have few working pages there and lately I have created some folders - simply domain names (like example.com for MU installation) for one of my freelancer friend.
So domains folders were created and ready for my friend to update (he was working on my page at his localhost first and then he just wanted transfer the database to my server and do some other staff).
But before updating I saw some "hacker" already install those unused domains on my site (by sqlite). On screen I saw information that I should not leave install.php file, with admin login info and pass... Well he was right. But installing drupal without access to password protected database is something I just... well I have not been prepared for this, didn't know its even possible.
So now I want to know what this "hacker" could do. He probably couldn't have used my working mysql databases (didnt know user name/pass), so there are safe. He got access to my modules, so he know what modules I have use (by uninstalling them he just uninstall them on "his created database", not on local files, so not a big deal). What else ? Should i replace all drupal files (beside sites) ?
I have deleted all settings.php files (delault folder) - inside one i have found:
$databases = array (
'default' =>
array (
'default' =>
array (