Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

After some sort of hacking, the main URL of my website now redirects to a fake antivirus page. How can I remove this thing?

share|improve this question

migrated from stackoverflow.com Apr 22 '11 at 17:53

This question came from our site for professional and enthusiast programmers.

marked as duplicate by jscott, GregD, Iain, Scott Pack, DanBig Apr 22 '11 at 18:35

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

    
It is recommended that you contact your hosting provider and explain the situation. They should be able to help you. –  Oh Danny Boy Apr 22 '11 at 17:51
    
sooo cool! looks real! but i have linux ;) –  BlackBear Apr 22 '11 at 17:51

1 Answer 1

Your server has been compromised/defaced so I give you the same advice I gave on a similar question:

Normally, it's very difficult to re-create all the attackers steps and the best solution is to reinstall the compromised servers and restore everything from the backups. On the other hand, you need to perform some forensics in order to figure out what has possibly happened and preventing it from happening again.

Here's a list of things worth checking:

  • see if there are known vulnerabilities in your webserver and your ftp server versions
  • take a look at every logfiles you can, especially the webserver, the ftp server and the system ones. In the webserver logfiles, check for posts
  • are there any services running that you don't need? Are they accessible from the Internet? Shut them now, check their logs and check for possible known vulnerabilities.
  • run rootkit checkers. They're not infalible but can lead you in the right direction. chkrootkit and especially rkhunter are the tools for the job
  • run nmap from outside of your server and check if there is something listening on any port that shouldn't be.
  • if you've a rrdtool trending application (like Cacti, Munin or Ganglia) take a look the graphs and search for a possible time frame of the attack.

Also, always keep this is mind:

  • shut down all the services you don't need
  • backup everything you need to rebuild your server and test backups on a regular basis
  • follow the least privilege principle
  • have your services updated, especially regarding security updates
  • don't use default credentials

Hope this helps!

share|improve this answer
    
And by the way, they probably made the redirect on the contents of your index page. Hope this helps. –  Marco Ramos Apr 22 '11 at 18:23
    
It does help, thank you very much ! –  user79232 Apr 22 '11 at 18:31
    
don't use the same passwords as before when you rebuild... –  cwheeler33 Apr 22 '11 at 22:18