Site was defaced help please

[pg001]

Update: My friend confirmed it is indeed a shell. The guy who he asked for help regarding some group images issue apparantly said he put a shell and threatened him he won't leave him alone.

Please any help would be helpful to remove it completely.

[VoIP]

Change the password on the ftp.
Change password for cpanel
Backup sql database
Remove all files from the ftp
reinstall mybb
use phpmyadmin and upload your database.

Since it's hard to know what he did, he could of shelled the theme the files or anything! But the first couple of steps is crucial. Just in case hes not keylogged for some odd reason. Should bring him over here. It's better to explain it to him. If he still needs help tell him to provide me his session id and pass over teamviewer.

[pg001]

That's the problem I cannot delete the file from ftp or from file manager. It is a .htaccess file. I have mailed the customer support to delete it hope they help soon.

[VoIP]

I don't understand how a .htaccess can regenerate with no script being ran. Maybe post the content inside of the .htaccess

Sorry about the late reply.