Sites Hacked -- How to Fix?

Eric Lorence

15 years ago

Showing a 404 not found for me, sure it was hacked?

Maybe a htaccess problem.

Just contact your host support.

Thanks

{{ DiscussionBoard.errors[462904].message }}

zeurois

15 years ago

ZoRLu - - - z0rlu.blogspot.com - - - experl.com this is it ?

What scripts do you use on-site?

If you don't use any or it's plain html or whatever, then you may have to consider changing your hosting provider.

Thanks
2 replies

Signature

Boost Your Conversion Rates & Skyrocket Your Sales by Using Scarcity

{{ DiscussionBoard.errors[462911].message }}

Eric Lorence 15 years ago

Or FTP and remove the "index.html" file,

Missed that one...

Then hove your host run a scan, change all your passwords.
- Thanks
{{ DiscussionBoard.errors[462928].message }}

Andy Money

15 years ago

Originally Posted by zeurois

ZoRLu - - - z0rlu.blogspot.com - - - experl.com this is it ?

What scripts do you use on-site?

If you don't use any or it's plain html or whatever, then you may have to consider changing your hosting provider.

Plain HTML on some and wordpress on others.

Thanks
1 reply

Signature

[GET] TUBE-A-ZON: Infinite Amazon Earnings with YouTube? Full White Paper + Video Bonuses
JUST >>> $1 >>> ONE BUCK >>> ONE DOLLAR

{{ DiscussionBoard.errors[462962].message }}

zeurois

15 years ago

Originally Posted by Andrew Maule

Plain HTML on some and wordpress on others.

Strong FTP password?

Thanks
1 reply

Signature

Boost Your Conversion Rates & Skyrocket Your Sales by Using Scarcity

{{ DiscussionBoard.errors[462964].message }}

Andy Money

15 years ago

Very. Here's my suspicion - the programmer I just hired and had to fire executed something via a script he uploaded before being kicked out. The password is letters and numbers and he doesn't know it.

Thanks
2 replies

Signature

[GET] TUBE-A-ZON: Infinite Amazon Earnings with YouTube? Full White Paper + Video Bonuses
JUST >>> $1 >>> ONE BUCK >>> ONE DOLLAR

{{ DiscussionBoard.errors[463004].message }}

richdirtygirl

15 years ago

OMG!

this is horrible... I'm not going to put the link... but, the default goes to a index.php that was removed, that is why the 404 appears.

If you change it by index.html, there is a horrible, horrible image and something against Israel.

Get in via ftp and remove that file...

not sure what else is ruined, but yes there is some damage there...

if you had a wordpress blog there and they killed your index.php, well, you better have a backup or you will need professional help to recover it.

EDIT: Oh... Talltom, we were posting at the same time. I see you saw it too...
EDIT AGAIN: Must be blind... Zeurois saw it first... shh too upsetting...

RDG

Thanks
1 reply

Signature

[WSO] Crazy Offer: Get access to my UNRESTRICTED PLR Article Directory for coins.
[FREE WSO] Step by Step guide to record and edit podcasts. Newbie friendly.
2 PLR articles a day FREE for a whole year!
Uncensored... Wanna play with me? ;) http://twitter.com/richdirtygirl
Blog fun! http://www.richdirtygirl.com/

{{ DiscussionBoard.errors[463039].message }}

Floyd Fisher

15 years ago

Originally Posted by richdirtygirl

OMG!

this is horrible... I'm not going to put the link... but, the default goes to a index.php that was removed, that is why the 404 appears.

If you change it by index.html, there is a horrible, horrible image and something against Israel.

Get in via ftp and remove that file...

not sure what else is ruined, but yes there is some damage there...

if you had a wordpress blog there and they killed your index.php, well, you better have a backup or you will need professional help to recover it.

EDIT: Oh... Talltom, we were posting at the same time. I see you saw it too...

RDG

That is a defacement. Sounds like the host needs a nudge to upgrade their security.

I got this a couple of years back...turned out an insecure calendar script run by someone else gave hackers root access...and rewrote all home/index/god knows what else to the hacked page.

Thanks
1 reply

{{ DiscussionBoard.errors[463088].message }}

Talltom1 15 years ago

Actually Floyd, I suspect the previous programmer 'exacted' some revenge since he was called on the carpet when he didn't deliver the services he said he could.

This probably isn't a host related issue.

Talltom
- Thanks
Signature
{{ DiscussionBoard.errors[463121].message }}

AgileHosting

15 years ago

Originally Posted by Andrew Maule

Very. Here's my suspicion - the programmer I just hired and had to fire executed something via a script he uploaded before being kicked out. The password is letters and numbers and he doesn't know it.

LOL, well there you go.

Delete all of the files on the site (as you don't know if he thoughtfully installed a backdoor somewhere) and re-upload a clean backup, that he hasn't touched.

Voila!

Bailey

Thanks
1 reply

{{ DiscussionBoard.errors[463144].message }}

richdirtygirl

15 years ago

Originally Posted by AgileHosting

LOL, well there you go.

Delete all of the files on the site (as you don't know if he thoughtfully installed a backdoor somewhere) and re-upload a clean backup, that he hasn't touched.

Voila!

Bailey

If he has any script installed via cpanel, will make a BIG mess deleting the files directly. The type of mess that needs help from the hosting or to delete the whole account if you have a reseller account (something related with a file saving the info of the installed scripts in Fantastico, it happened to me once).

Need to uninstall first and delete what's left later.

Do you know what file needs to be edited and what to change?

RDG

Thanks

Signature

[WSO] Crazy Offer: Get access to my UNRESTRICTED PLR Article Directory for coins.
[FREE WSO] Step by Step guide to record and edit podcasts. Newbie friendly.
2 PLR articles a day FREE for a whole year!
Uncensored... Wanna play with me? ;) http://twitter.com/richdirtygirl
Blog fun! http://www.richdirtygirl.com/

{{ DiscussionBoard.errors[463244].message }}

Floyd Fisher

15 years ago

I can't connect to the site, it shows 'site not found'.

That's not a hack, it's an outage.

Thanks

{{ DiscussionBoard.errors[462997].message }}

Talltom1

15 years ago

Andrew

Check this out....

http://www.webhostscores.com/index.html

Let me know if you want some help getting this resolved.

Talltom1

Thanks

Signature

{{ DiscussionBoard.errors[463018].message }}

rlnorthcutt

15 years ago

Web Hosting Reviews, Rankings & Pricing - Web Hosting Rankings

Appears to be the main page (unless this is the old one)... you are lucky that the "hacked" index is HTML and the site is looking for .php

Yeah - get that page out of there, check the server logs to see when it was done and by which IP address. Your host should be able to get fixed up in no time.

If this was an "inside job", then you got lucky that this wasn't much worse. Where did you find this developer? You should check RAC, GAF, etc. and see if they are there... leave comments explaining the situation.

You might be able to prevent others from having similar problems by working with this person.

Ron

Thanks

Signature

*** WSO - PR4 and over 2700 Backlinks on Autopilot - Early Bird Special ***

*** FREE Divine Openings for Warriors - Details on this WF thread ***

--> FREE LOA and Spiritual Books <--

{{ DiscussionBoard.errors[463270].message }}

Big Till

15 years ago

I understand that WP sites are easily hacked. Has anyone had that problem?

Thanks
1 reply

{{ DiscussionBoard.errors[463278].message }}

richdirtygirl 15 years ago

Originally Posted by Big Till

I understand that WP sites are easily hacked. Has anyone had that problem?

This doesn't seem to be the problem here...

Anyway... why don't to pay a visit to this thread?

http://www.warriorforum.com/main-int...ot-secure.html

we had a nice talk about wordpress and all that stuff...

RDG
- Thanks
Signature
[WSO] Crazy Offer: Get access to my UNRESTRICTED PLR Article Directory for coins.
[FREE WSO] Step by Step guide to record and edit podcasts. Newbie friendly.
2 PLR articles a day FREE for a whole year!
Uncensored... Wanna play with me? ;) http://twitter.com/richdirtygirl
Blog fun! http://www.richdirtygirl.com/
{{ DiscussionBoard.errors[463308].message }}

TheRichJerksNet

15 years ago

They probably went through your wordpress install..

James

Thanks
1 reply

{{ DiscussionBoard.errors[463328].message }}

Andy Money

15 years ago

Don't you think it's possible for the web host to sort of "scan" the server to make sure there aren't any other "backdoors"? I really don't want to delete/restore all 20+ sites...

Thanks
1 reply

Signature

[GET] TUBE-A-ZON: Infinite Amazon Earnings with YouTube? Full White Paper + Video Bonuses
JUST >>> $1 >>> ONE BUCK >>> ONE DOLLAR

{{ DiscussionBoard.errors[463583].message }}

richdirtygirl

15 years ago

Originally Posted by Andrew Maule

Don't you think it's possible for the web host to sort of "scan" the server to make sure there aren't any other "backdoors"? I really don't want to delete/restore all 20+ sites...

Contact them and let them know what happened so they can make sure it is not on their end. You don't know where this came from and they don't know it either... if you have been hacked they have to know.

At the same time, go over your log files and try to find where they got in and what they did. It is not straightforward... and you will have to be very patient. But it can be done.

Following their steps you will also know which parts have been compromised.

With that info in hand you will be able to decide what to do. Not before. Everything else is just chit chat...

Meantime... please take that index.html... it is awful...

RDG

Thanks
1 reply

Signature

[WSO] Crazy Offer: Get access to my UNRESTRICTED PLR Article Directory for coins.
[FREE WSO] Step by Step guide to record and edit podcasts. Newbie friendly.
2 PLR articles a day FREE for a whole year!
Uncensored... Wanna play with me? ;) http://twitter.com/richdirtygirl
Blog fun! http://www.richdirtygirl.com/

{{ DiscussionBoard.errors[463764].message }}

Andy Money 15 years ago

Ok, so thanks for the help everyone. Talltom1 helped me out big time and pointed out it's the index.php/index.html files that got over written. If you have a site on your own server BACK THAT UP AS OFTEN AS POSSIBLE. I back up weekly and luckily had everything I needed to get back to normal. In a few of the sites I just had to delete the index.php or index.html files and I was fine, in other folders I had to recopy the original index file back onto the server. If I didn't have that I'd be up a creek BIG TIME.

Now I just have to find out HOW this happened to keep it from happening again.
- Thanks
Signature

[GET] TUBE-A-ZON: Infinite Amazon Earnings with YouTube? Full White Paper + Video Bonuses
JUST >>> $1 >>> ONE BUCK >>> ONE DOLLAR
{{ DiscussionBoard.errors[463834].message }}

TheRichJerksNet

15 years ago

Andrew,
It depends upon who your host is but any host is not going to support 3rd party apps that have issues. If it is coming from a 3rd party app such as wordpress then they host will leave that issue up to you. If they scan they will scan their server for issues and that will be about it.

James

Thanks

{{ DiscussionBoard.errors[463615].message }}

Sites Hacked -- How to Fix?

Trending Topics

How did you turn it all around?

Any thoughts on golf's latest phenom...Scottie Scheffler??

What's the Best IM-Related Skill to Learn Today That Can Help in the Future?

Some interesting stats about brand comms

best high quality crypto traffic.