Domain has been affected by malware. Any insight?

11 years ago

Originally Posted by shawoon98

One of my domains has been affected by malware. When someone is clicking the link to my domain name, they are visiting some other sites (particularly porn sites). I've contacted the hosting service and they said that they've cleaned up the malicious script. But I still can see them using sucuri dot net.

Any insight on what steps I should take?

Log into your site using FTP and check for a file named .htaccess. Has this file been modified lately?

[ 1 ] Thanks

Signature

Discover the fastest and easiest ways to create your own valuable products.
Tons of FREE Public Domain content you can use to make your own content, PLR, digital and POD products.

{{ DiscussionBoard.errors[7421091].message }}

Kevin Birch

11 years ago

If its wordpress, usually your .htaccess file has been compromised.

You can take edit it to a look at it to see what it contains.

Delete it and replace it with a clean version . . . and change your password!

[ 1 ] Thanks
1 reply

Signature

Skyrocket Your Ebay Earnings With This Proven, Step by Step Ebay / Amazon System - WSO

Find out how I get subscribers for pennies on the dollar

{{ DiscussionBoard.errors[7421093].message }}

shawoon98

11 years ago

Yes there were other scripts. I cleaned it. Now it's okay. Thanks a lot Kevin.

Originally Posted by Kevin Birch

If its wordpress, usually your .htaccess file has been compromised.

You can take edit it to a look at it to see what it contains.

Delete it and replace it with a clean version . . . and change your password!

Thanks

Signature

ALERT: LocalBiz Owners Will Pay You $97-$197 Per Month for LEGALLY Stealing Groupon's List

$5 A Day Online. From Today. Guaranteed

FREE CASE STUDY- 23,059 FREE BUYER TRAFFIC PER MONTH

{{ DiscussionBoard.errors[7421513].message }}

yukon

Banned 11 years ago

If it's Wordpress it's most likely a free plugin or theme. Very few Wordpress sites with malware are actually hacked.

http://www.warriorforum.com/adsense-...ghlight=base64

[ 1 ] Thanks

{{ DiscussionBoard.errors[7421124].message }}

ElaineBedfordd

11 years ago

Recently I have ha dozens of WP sites affected and the malicious code was inserted in both the .htaccess and 2-3 of the theme's .php files. After you clean your .htaccess, make sure you CHMOD it to 644

[ 1 ] Thanks
2 replies

{{ DiscussionBoard.errors[7421532].message }}

Phil_t 11 years ago

I had several WP websites affected a few months ago. If you have other domains on the same server, I suggest you check those too. If you are using FTP, go through all your WP files and check the dates of folders/files to see if any of them have been modified recently. Also, it would be wise to change your password for your WP and hosting login.
- [ 1 ] Thanks
Signature

The Best WSO Ever - This Will Actually Make You Money

Phil The WSO Tester - Recommended WSOs

CPV Lab Discount â€“ $60 Off CPV Lab
{{ DiscussionBoard.errors[7421559].message }}

shawoon98

11 years ago

Dumb question. But how to change CHMOD to 644?

Originally Posted by ElaineBedfordd

Recently I have ha dozens of WP sites affected and the malicious code was inserted in both the .htaccess and 2-3 of the theme's .php files. After you clean your .htaccess, make sure you CHMOD it to 644

Thanks
2 replies

Signature

ALERT: LocalBiz Owners Will Pay You $97-$197 Per Month for LEGALLY Stealing Groupon's List

$5 A Day Online. From Today. Guaranteed

FREE CASE STUDY- 23,059 FREE BUYER TRAFFIC PER MONTH

{{ DiscussionBoard.errors[7421614].message }}

Phil_t 11 years ago

I think he is talking about permissions. Either do this via FTP or logging into your host. You can right-click the file to change the permissions.
- [ 1 ] Thanks
- 2 replies
Signature

The Best WSO Ever - This Will Actually Make You Money

Phil The WSO Tester - Recommended WSOs

CPV Lab Discount â€“ $60 Off CPV Lab
{{ DiscussionBoard.errors[7421657].message }}
- Phil_t 11 years ago
  
  By the way, after my sites got attacked I installed a security plugin on each domain. It's free and there are several options for WP.
  
  [ 1 ] Thanks
  
  Signature
  
  The Best WSO Ever - This Will Actually Make You Money
  
  Phil The WSO Tester - Recommended WSOs
  
  CPV Lab Discount â€“ $60 Off CPV Lab
  
  {{ DiscussionBoard.errors[7421663].message }}
- shawoon98 11 years ago
  
  Great. It worked. Thanks. It was set to 644 by the hosting service when I asked for help.
  
  Originally Posted by Phil_t
  
  I think he is talking about permissions. Either do this via FTP or logging into your host. You can right-click the file to change the permissions.
  
  Thanks
  
  Signature
  ALERT: LocalBiz Owners Will Pay You $97-$197 Per Month for LEGALLY Stealing Groupon's List
  
  $5 A Day Online. From Today. Guaranteed
  
  FREE CASE STUDY- 23,059 FREE BUYER TRAFFIC PER MONTH
  
  {{ DiscussionBoard.errors[7421671].message }}
ElaineBedfordd 11 years ago

Originally Posted by shawoon98

Dumb question. But how to change CHMOD to 644?

Open your FTP client (say Filezilla), navigate to your root directory, find the .htaccess file and right-click on it, you should see the option to CHMOD - it is called "File permissions..." in FIlezilla, then change it to 644.
- [ 1 ] Thanks
{{ DiscussionBoard.errors[7421664].message }}

brettb

11 years ago

When it happened to me, the reason was that I had malware on my PC that stole my FTP password.

Check your own PC as well as your web server!

Thanks
1 reply

Signature

ÖŽ FindABlog: Find blogs to comment on, guest posting opportunities and more ÖŽ

{{ DiscussionBoard.errors[7421809].message }}

Charlie Ratcliffe 11 years ago

Originally Posted by brettb

When it happened to me, the reason was that I had malware on my PC that stole my FTP password.

Check your own PC as well as your web server!

Good idea to check your pc too! I installed Malwarebytes Anti-malware and I can see it is blocking certain traffic surprisingly frequently!
- Thanks
{{ DiscussionBoard.errors[7421895].message }}

Domain has been affected by malware. Any insight?

Trending Topics

A healthy fascination for Hollywood...

How did you turn it all around?

Any thoughts on golf's latest phenom...Scottie Scheffler??

What's the Best IM-Related Skill to Learn Today That Can Help in the Future?

best high quality crypto traffic.