My site has been hacked

  • Around 11:30am our website went down, when it came back up there were some vulgar words appearing as a link but not an actual link on our mobile version. We contacted our host and installed a security program that we were told should take care of our problem. It did take off the words and everything seemed fine. On 4/18/2015 around 10:00pm I noticed a site page popping up on our website like it was a page that was part of our website that was a porn site, we called ipage (our host) and once we finally got through they noticed another problem, they called it a deny access attack where there was so much traffic hitting our site that we had been denied access. Once the fixed that problem they couldn’t find the other issue so they thought the security program found and fixed it. Ipage researched it and found no unusual or suspicious information. They could not find any IP address that would have done it. We hung up and then at around 12:11am CST our site was shut down again by what Ipage is calling a deny access attack again we called them they got our site up, looked for any clues as to who it may be that is doing this and found nothing. Around 3:00am CST we checked the site again and our homepage was bringing up a gay porn site. Once again we called Ipage and they fixed that and while they were fixing that they say our site immediately getting around 400 hits but they could not see where they were coming from or anything and the site was shut down again by too many hits within an hour.

    our site is https://www.101dreamvacations.com

Viewing 5 replies - 16 through 20 (of 20 total)

  • I am sorry, I should have posted my solution. In my case it was easy, but that could be different for someone else. I edited the finctions.php file and deleted the malicious code ( very obvious ) from the beginning of the file.

    Andrew Nevins

    (@anevins)

    WCLDN 2018 Contributor | Volunteer support

    The code that results in the hacker walking back into your website, the “backdoor” is more difficult to find. Make sure you don’t just clear a symptom.

    Andrew, I totally agree. All I have done is fixing the symptoms and now keeping my finger crossed.

    @lazlo369

    Make sure to enable “show hidden files” in whatever ftp/sftp or similiar program you use and look for files and/or folders that begins with a dot (the file .htaccess in the webroot is normally ok, unless someoneone have hacked that one too).

    Thanks !

Viewing 5 replies - 16 through 20 (of 20 total)
  • The topic ‘My site has been hacked’ is closed to new replies.