0

Possible Duplicate:
My server's been hacked EMERGENCY

Some pages of my website are distributing harmful software. How do I investigate and fix this?

Improve this question
3
  • 9
    If your site is distributing malware... for crying out loud don't share the URL for some doofus to click on!
    – Ben Pilbrow
    Apr 21, 2011 at 17:57
  • This question has been asked multiple times here. Short answer: Take site offline, wipe, rebuild and restore from known-good backups.
    – jscott
    Apr 21, 2011 at 18:00
  • @jscott, Gah, you beat me to it... wasn't in my favorite questions like I thought it was.
    – Chris S
    Apr 21, 2011 at 18:03

3 Answers 3

Reset to default
5

Call your hosting company, tell them your site's been compromised. They probably have standard procedures, but it boils down to delete everything and restore it from backup.

Improve this answer
3

Step 1: MAKE THE PROBLEM GO AWAY.
Take down the affected pages, block them with an Apache directive, something. Do it now. RIGHT NOW.

Step 2: Figure out how the hell it happened.
Check your server logs for anything funky.
If you're running forum/bbs/blog software consider it suspect (it may have a vulnerability, or you may have installed a vulnerable module or a bit of malware during recent upgrades?) If you give users FTP or SSH access look for anyone doing "something strange" (lots of failed login attempts followed by a success, users uploading stuff they normally wouldn't, etc.)

Step 3: Plug the hole.
Once you complete step 2 you'll know where the problem is. That usually leads you to a fix.
If this leads you to the conclusion that more than just a bit of web code was compromised (i.e. an attacker gained root/admin privileges on your box) it's time to wipe the machine as others have suggested.

Step 4: Don't let it happen again!
(Peruse the Security tag on here, or security.stackexchange.com for some ideas, but basically maintain some level of vigilance over your server. If something strange happens, find out why and make sure it's not someone being evil, etc.)

Improve this answer
2

Check out the logs to try and find out how they got in. Once you've determined that, patch the vulnerability and restore from a known good backup and ensure your Operating System as well as any web applications you use are up to date.

For obvious reasons I didn't actually click on your link, but I did check out the Google Safe Browsing page for your site. You've got malware coming from a domain other than your own, which is often indicative of inserted <iframe>'s or <script>'s.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .