Finally found out my hosting has been hacked!!

13 replies
Would like to hunt them down and smash em.... all my sites infected with malware on hosting...have a guy on odesk fixing it..geez,,

here is the text file of it...any thoughts or hints let me know...lost a good chunk of change this week..


IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|baidu|youtube|wikipedia|qq|ex cite|altavista|msn|netscape|aol|hotbot|goto|infose ek|mamma|alltheweb|lycos|search|metacrawler|bing|d ogpile|facebook|twitter|blog|live|myspace|mail|yan dex|rambler|ya|aport|linkedin|flickr|nigma|liveint ernet|vkontakte|webalta|filesearch|yell|openstat|m etabot|nol9|zoneru|km|gigablast|entireweb|amfibi|d moz|yippy|search|walhello|webcrawler|jayde|findwha t|teoma|euroseek|wisenut|about|thunderstone|ixquic k|terra|lookle|metaeureka|searchspot|slider|topsev en|allthesites|libero|clickey|galaxy|brainysearch| pocketflier|verygoodsearch|bellnet|freenet|firebal l|flemiro|suchbot|acoon|cyber-content|devaro|fastbot|netzindex|abacho|allesklar| suchnase|schnellsuche|sharelook|sucharchiv|suchbie ne|suchmaschine|web-archiv)\.(.*)
RewriteRule ^(.*)$ russian site url here [R=301,L]
RewriteCond %{HTTP_REFERER} ^.*(web|websuche|witch|wolong|oekoportal|t-online|freenet|arcor|alexana|tiscali|kataweb|orang e|voila|sfr|startpagina|kpnvandaag|ilse|wanadoo|te lfort|hispavista|passagen|spray|eniro|telia|bluewi n|sympatico|nlsearch|atsearch|klammeraffe|shareloo k|suchknecht|ebay|abizdirectory|alltheuk|bhanvad|d affodil|click4choice|exalead|findelio|gasta|gimpsy |globalsearchdirectory|hotfrog|jobrapido|kingdomse ek|mojeek|searchers|simplyhired|splut|the-arena|thisisouryear|ukkey|uwe|friendsreunited|jaan |qp|rtl|search-belgium|apollo7|bricabrac|findloo|kobala|limier|ex press|bestireland|browseireland|finditireland|iese arch|ireland-information|kompass|startsiden|confex|finnalle|gul esider|keyweb|finnfirma|kvasir|savio|sol|startside n|allpages|america|botw|chapu|claymont|clickz|clus h|ehow|findhow|icq|goo|westaustraliaonline)\.(.*)
RewriteRule ^(.*)$ russian site url here [R=301,L]
</IfModule>







RewriteEngine On
#finally #found #hacked #hosting
  • Profile picture of the author mdc2727
    bluehost.com no help at all!!!!!!!!!!!!!
    Signature
    Our review site for WSOs' and Affiliate Marketing Tools. Read our reviews before you buy!
    {{ DiscussionBoard.errors[5704283].message }}
  • Profile picture of the author HarrieB
    Download your entire website via HTTRACK website copier if its HTML or use back up buddy and export all the data.

    Then go to each of the files and search for something like the error using the find feature [CTRL+f} button on your keyword. and remove the code.
    {{ DiscussionBoard.errors[5704540].message }}
  • Profile picture of the author abhinavsidanaa
    Great Information hope it will not happen with me
    Signature
    High Quality Seo - http://www.infosoftware.biz
    Skype: abhinavsidana
    {{ DiscussionBoard.errors[5704591].message }}
  • Profile picture of the author PlotHost
    Do you have a script like wordpress on the site ? You were using the latest version ?
    Signature

    PlotHost - http://www.plothost.com
    99.9% uptime | 15 days money back | 24/7 support

    {{ DiscussionBoard.errors[5704661].message }}
  • Profile picture of the author UMS
    Not sure what type of thoughts you are after.

    In case the rewrite isn't obvious, it's essentially making all the various search engines see a 301 redirect to the Russian site that the hackers what to gain a boost to.
    {{ DiscussionBoard.errors[5704673].message }}
    • Profile picture of the author mdc2727
      forgot to update wordpress and that is probably how the little twerps got in..
      Signature
      Our review site for WSOs' and Affiliate Marketing Tools. Read our reviews before you buy!
      {{ DiscussionBoard.errors[5705799].message }}
      • Profile picture of the author mdc2727
        any idea how to find where malware would be located?? what file most likely
        Signature
        Our review site for WSOs' and Affiliate Marketing Tools. Read our reviews before you buy!
        {{ DiscussionBoard.errors[5708269].message }}
        • Profile picture of the author SiteMiracle
          You can ask your web host to restore your sites from their backup.
          {{ DiscussionBoard.errors[5708493].message }}
          • Profile picture of the author richrowley
            Originally Posted by SiteMiracle View Post

            You can ask your web host to restore your sites from their backup.
            Yes do this before you hire anyone. My hosting company does this live within a few minutes 24/7
            {{ DiscussionBoard.errors[5708502].message }}
            • Profile picture of the author Jeff Henshaw
              bluehost.com no help at all!!!!!!!!!!!!!
              I've used several web hosts in my ten or more years on-line. The only one ever to get hacked was BlueHost. That's why I no longer use them or recommend them.

              Just my experience,

              Jeff.
              {{ DiscussionBoard.errors[5709141].message }}
              • Profile picture of the author AMiRU
                Originally Posted by Jeff Henshaw View Post

                I've used several web hosts in my ten or more years on-line. The only one ever to get hacked was BlueHost. That's why I no longer use them or recommend them.

                Just my experience,

                Jeff.
                No matter where your site is hosted, if a hacker wants to hack your site, they can do it. Its very hard to secure shared hosting due to the "shared" environment.
                {{ DiscussionBoard.errors[5711775].message }}
  • Profile picture of the author Sillysoft
    You have wordpress and it got hacked? Shocking...
    {{ DiscussionBoard.errors[5709149].message }}
  • Profile picture of the author Kingfish85
    I don't think that's related to the hosting provider, nor should they be blamed for not helping because you didn't keep your Wordpress up to date. BlueHost seems to host a lot of "shady" websites, which I'm sure attracts the kind of viewers you don't want..
    Signature

    |~| VeeroTech Hosting - sales @ veerotech.net
    |~| High Performance CloudLinux & LiteSpeed Powered Web Hosting
    |~| cPanel & WHM - Softaculous - Website Builder - R1Soft - SpamExperts
    |~| Visit us @veerotech Facebook - Twitter - LinkedIn

    {{ DiscussionBoard.errors[5709217].message }}

Trending Topics