16 {{ upvoteCount | shortNum }}
16 {{ upvoteCount | shortNum }}

My site was hacked. Here is what I learned

by Chris Thompson
13 replies
I used to read these threads and think "oh, it won't happen to me".
Then it did. And it will happen to you also. Be ready.

Here is what happened to me now for the 2nd time.
I have an account at Hostmonster that I use for some projects I'm outsourcing. The sites were hacked and we got a warning about trojans if we tried to visit the sites.

I logged in via FTP to look at what files were modified since I had last seen it running cleanly. Pretty much all index.php files had iframes injected in them. A big pain in the ass, but I cleaned up all files for all wordpress sites, theme files, etc. Took a couple of hours.

We changed our site passwords (FTP stuff, etc).

That was back in March. Today I got an email from my outsourcer that the same thing happened again. I login again, sure enough, same deal.

I clean the files AGAIN. But this time I go into hostmonster (cpanel) and I download my FTP access logs. I start looking through them and I can clearly see 100% verifiable proof that this was indeed done through FTP, so someone has my password and changed things on me.

All of the internet digging I've done suggests that there is a trojan on someone's PC, and when they login to FTP (via FileZilla), passwords are stolen.

I have FTP access as does one of my employees. We both use FileZilla. He's on a PC and I'm on Mac and PC. It could be either one of us. Problem is I have NO idea how to find out if my PC is infected with this trojan.

Anyone have any ideas?

I've changed my password again. I can see the logs. The attacker comes in through the primary FTP account.
#hacked #learned #site
  • Profile picture of the author wiseleo
    Changing the password on a suspect computer? Umm... No

    Be sure to change your database password. An attacker with ftp access knows your DB password as it's in plain text in your WP directory.

    I normally just nuke the system (notice what I sell? ) and rebuild it.

    I am pretty sure it's a PC that has been compromised. If you are on a wireless network, your password can be intercepted over the air by a trojan from another computer.

    You should never clean up files manually. Have a clean backup and plan to re-upload the entire theme in the event of a security breech.

    How to detect? Many ways.

    One way is to run NETSTAT -v -b from command prompt on each computer
    You can download Cureit from Dr.Web CureIt! — ??????? ????????? ?????????! ??????? ???????, ?????? ?????????? ?????????! (not an aff link) for free. Yes, it's a Russian company. Where do you think all the crimeware comes from? They've been in antivirus business since 1980s
    Signature

    I run a few startups that address critical business problems. PM or Skype me about joining my direct affiliate programs. My products are business continuity and customer testimonials. Both are unique.

    {{ DiscussionBoard.errors[2086948].message }}
    • Profile picture of the author Chris Thompson
      Originally Posted by wiseleo View Post

      Changing the password on a suspect computer? Umm... No
      I have no idea where you got the idea that we changed computer passwords. We change FTP passwords, but thank for providing your thoughts on the situation. I never considered the whole DB password issue that you mentioned, but absolutely true. Good point. The trojan that is affecting people here doesn't seem to look for DB passwords though. It just compromises your index, default, home and other PHP files and injects iframe code to contaminate more PCs.
      {{ DiscussionBoard.errors[2090815].message }}
      • Profile picture of the author bretski
        I also use Super Anti Spyware...I know; very hokey sounding name but you'd be surprised by all the stuff that it finds. In my book it's the best on the market right now and it's free.

        Remember to turn off System Restore and boot into safe mode. Many of these guys are getting really clever and will hide the stuff in system restore.

        SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!
        Signature
        ***Affordable Quality Content Written For You!***
        Experience Content Writer - PM Bretski!
        {{ DiscussionBoard.errors[2090836].message }}
  • Profile picture of the author Jesus Perez
    Here are the programs I run to eliminate my PC of trojans and malware.

    Malwarebytes
    Ad-Aware by Lavasoft - Antivirus software, free spyware removal, firewall
    Windows Defender: Home Page (Yes, Defender actually works well.)

    I used to use SpyBot also, but the above always work like magic. And they're free.

    You need to find it and axe it. So does your friend.

    If neither of you find anything, then it's possible you may have a vulnerability on your website, itself. Or a plugin in WP that's old.
    Signature

    {{ DiscussionBoard.errors[2086956].message }}
    • Profile picture of the author Chris Thompson
      Originally Posted by BlueSquares View Post

      Here are the programs I run to eliminate my PC of trojans and malware.

      Malwarebytes
      Ad-Aware by Lavasoft - Antivirus software, free spyware removal, firewall
      Windows Defender: Home Page (Yes, Defender actually works well.)

      I used to use SpyBot also, but the above always work like magic. And they're free.

      You need to find it and axe it. So does your friend.

      If neither of you find anything, then it's possible you may have a vulnerability on your website, itself. Or a plugin in WP that's old.
      Hey thanks for the ideas on software to recommend to my employee. The more I think about it the more I'm sure it was his PC, and possibly the internet cafe PC he used even after shifting to the web-based FTP program, because once infected with a trojan the web-based FTP program would probably still be vulnerable.

      I am sure that this is NOT a plugin problem. Like I said, I checked the FTP logs and the intruder came in via FTP. There is no way to use a WP plugin to grab FTP login info. At least none that I've ever read about.
      {{ DiscussionBoard.errors[2090825].message }}
      • Profile picture of the author Jesus Perez
        Originally Posted by Chris Thompson View Post

        ...and possibly the internet cafe PC he used even after shifting to the web-based FTP program...
        OMG! He's using an Internet Cafe PC?!

        WITH FTP PASSWORDS?!

        I can tell you right now that the many, many internet cafe's have "keylogger" programs (and in some cases USB devices) installed that grab passwords and use them for identity theft later on.

        Also, many hackers park nearby and "sniff" the wireless connections for passwords as well.

        Your friend needs to be very careful! Not just with your FTP passwords, but with his own.
        Signature

        {{ DiscussionBoard.errors[2090848].message }}
  • Profile picture of the author einfohound
    I have used Avast (free version) for several years on every PC I have had (many) and have never had a virus infection.
    Signature

    Get quality MegaSpun Articles for less than $4 each!

    {{ DiscussionBoard.errors[2086997].message }}
  • Profile picture of the author PCRoger
    Take a look at ComboFix (FREE):

    Free Computer Consultant ………. Daily Insights Blog Archive How To Clean Your PC From Malware When Nothing Else Works

    Regards,
    PCRoger.
    Signature
    Track your affiliate sales back to the ARTICLE or WEBSITE that generated the sale. CBSaleTracker

    I was making money in days with the 4 Day Money Making Blueprint
    {{ DiscussionBoard.errors[2087117].message }}
  • Profile picture of the author danstat
    This can be more serious than you think. Is this the only site you have a problem with? Do you check personal stuff as well on that computer? Firstly, I would use a different computer to change the password and only log into that account on the different computer.

    Some programs are cloaked and go undetected by anti-virus, spyware, malware, etc. Have you ever heard of keystroke logging? This is where what you typed in is being captured and sent out undetected to the hacker who than compiles and uses at different times to get into your websites.

    I would use a different computer for now changing all your passwords. Not fun, but it took a couple of hours to fix the hacked problem anyway.

    This should help.

    Dan
    Signature
    Learn Super Simple Affiliate Secrets Now!
    Why Struggle? http://www.onlinebusinessbuildingsuccess.com/ssas
    {{ DiscussionBoard.errors[2090865].message }}
  • Profile picture of the author Chris Thompson
    Guys - thanks for the cautions, but you are extanding things WAY past the facts. I already told you that I looked specifically at the trojan that was causing this and it is caused by visiting a site with iframe injection,and it then hijacks FTP info to replicate itself on sites. Simple as that.

    I'm sure the cafe computer was not safe - his computer was on the fritz and I bought him a new one since then, and now he's protected.
    {{ DiscussionBoard.errors[2094766].message }}
  • Profile picture of the author MaryT
    It happened to me, and found it by accident

    i was hacked by a script that collect all the firefox password, probably attached to some download

    everybody is sold on firefox security

    solution: add a master password to your firefox password manager

    and use one hard to guess with 30 characters and symbols inside

    other solution, use password manager software only to store your passwords

    hard lesson, as they destroyed some of my sites in the process
    hard pill to swallow, as i didn't have a recent backup and hostgaor backup wasthe last one with the broken site(the site broken was earning 20Euros/month in adsense)

    lesson learned, passwords and backup is critical when you have websites business

    have a great day
    Mary T

    Originally Posted by Chris Thompson View Post

    I used to read these threads and think "oh, it won't happen to me".
    Then it did. And it will happen to you also. Be ready.

    Here is what happened to me now for the 2nd time.
    I have an account at Hostmonster that I use for some projects I'm outsourcing. The sites were hacked and we got a warning about trojans if we tried to visit the sites.

    I logged in via FTP to look at what files were modified since I had last seen it running cleanly. Pretty much all index.php files had iframes injected in them. A big pain in the ass, but I cleaned up all files for all wordpress sites, theme files, etc. Took a couple of hours.

    We changed our site passwords (FTP stuff, etc).

    That was back in March. Today I got an email from my outsourcer that the same thing happened again. I login again, sure enough, same deal.

    I clean the files AGAIN. But this time I go into hostmonster (cpanel) and I download my FTP access logs. I start looking through them and I can clearly see 100% verifiable proof that this was indeed done through FTP, so someone has my password and changed things on me.

    All of the internet digging I've done suggests that there is a trojan on someone's PC, and when they login to FTP (via FileZilla), passwords are stolen.

    I have FTP access as does one of my employees. We both use FileZilla. He's on a PC and I'm on Mac and PC. It could be either one of us. Problem is I have NO idea how to find out if my PC is infected with this trojan.

    Anyone have any ideas?

    I've changed my password again. I can see the logs. The attacker comes in through the primary FTP account.
    Signature

    ..--> White Death : the Sniper Who Killed 705..in 100 Days. Will you be the next!..coming soon..
    ...
    ..-->*FREE WSO*<-- Beat Super Affiliates at their own game..Shocking! Sniper Affiliate Tools.[*FREE WSO*]

    {{ DiscussionBoard.errors[2094963].message }}
  • Profile picture of the author Chris Thompson
    Originally Posted by precious007 View Post

    I do believe that your website hasn't been hacked ..

    You're not using a proper anti-virus and unfortunately uploaded infected files to your server.

    Al.
    Hello McFly - anyone home? I already told you I looked at my FTP logs and all of the infected uploads came from FTP. Do you know anyone who goes around uploading index.php files to their wordpress blog? NOPE ... that's because nobody does it.
    {{ DiscussionBoard.errors[2117101].message }}

Trending Topics