Hello.

I have a DNN installation that was hacked yesterday, with the intruder replacing my default.aspx file and causing all of the portals to fail.  I have replaced with bad default.aspx with the correct one but now need to make sure I get my installation secured and have some questions I was hoping to get answered here.

1. I have been running an older version 04.05.01.  I know this is a very old version and do plan to upgrade it to the latest 04.09.XX version (last one before the 05 releases).  I also realize after doing some searching that most likely the vulnerability mentioned here:
http://www.dotnetnuke.com/News/SecurityPolicy/Securitybulletinno24/tabid/1188/Default.aspx
was the cause.  My mea culpas for not having upgraded the install until now.  I am hoping to get this corrected now.  Am I correct in believing this is in fact the source of the compromise?

2. Should I have any problems upgrading from 04.05.01 to 04.09.01 without doing any intermediary upgrades?  Is there anything I need to look out for/make sure I do when upgrading?

3. According to my managed hosting administrators:

"Upon investigation of the Home Directory (D:\dnnInstall) we noted the following: 
The Group "dnnusers" has "Full Control" of the directory. 
The Internet Guest Account has "Full Control" of most of the files with the directory. "

Does the Internet Guest Account need "Full Control" of any of the files in the dnninstall folder?  
Should I make sure these permissions are removed?

4. is there anything else I need to check/change to make sure my dnn install is secure?

5. Unrelated to this but I have been wanting to know for a while..I have many portals on this install; is there a recommended max number of portals that any one install should have on it?

6. Any other suggestions/help would be appreciated.

Thank you in advance for all of your help.

Thank you so much for your feedback on my problem.

Unfortunately, as much as I tried to follow your directions I failed at upgrading our dnn install.  I tried running the upgrade but received errors without any indication of what the problem was.  I kept trying to figure out the problem and at one point got a message that upgrade occurred but only the database had been upgraded and the files had not.  When I tried to run a portal everything functioned except being able to login, with errors saying some modules did not load.

I am a bit up against the wall and could really use some expertise help. 

By coincidence, you have helped me before in the past with some installation issues.  I still have you on my MSN Messenger from then.  Would it be OK to contact you again for help?  If you could remotely connect to my server and assist me with the upgrades I need to perform it would be very much appreciated and I would gladly pay your via paypal for your time.