-4

Possible Duplicate:
My server's been hacked EMERGENCY

A friend is experiencing a random redirect to an RU domain for two of her websites, along with a malicious cookie attack, as per a Norton pop-up everytime I load a page on her site.

I checked out her WordPress installation and I saw a suspicious plugin which I deleted, and I also cleaned up the .htaccess files which were clearly compromised with these Russian redirects.

However, even after ensuring all .htaccess files were clean, the site is still redirecting.

Any idea what I can do to diagnose, and rid the server of these issues, short of a fresh WordPress installation?

0

3 Answers 3

2

↓ Click the Pretty Cloud! ↓

Nuke it from orbit!

↑ You'll Like It!! ↑

1
  • I concur, good doctor. Once a system is compromised, 99% of the time it's best to just nuke it.
    – Hyppy
    Jun 12, 2012 at 17:56
2

Even if you manage to stop it redirecting, how are you ever going to trust it 100% again? Maybe there's other code that isn't as obvious, maybe it's stealing login credentials, maybe it's using the site to launch XSS attacks elsewhere, maybe they've popped an exploitable copy of tom_thumb.php onto the server and are using it to attack other sites.

The following is the standard answer for these kinds of questions,

How do I deal with a compromised server?

and I would ask you to seriously consider how you're going to trust the site without starting with a fresh install.

0

There is always the possibility of putting a second installation on the server (same version required) and diffing it against the damaged install. This should give you plenty of information on what was changed ... if you, however, have reason to suspect that root access has been gained to the server itself, do not trust it nor any passwords (ssh keys are OK) that have been used to authenticate against it.

Not the answer you're looking for? Browse other questions tagged .