My server's been hacked EMERGENCY
After some sort of hacking, the main URL of my website now redirects to a fake antivirus page. How can I remove this thing?
migrated from stackoverflow.com Apr 22 '11 at 17:53
This question came from our site for professional and enthusiast programmers.
Your server has been compromised/defaced so I give you the same advice I gave on a similar question:
Normally, it's very difficult to re-create all the attackers steps and the best solution is to reinstall the compromised servers and restore everything from the backups. On the other hand, you need to perform some forensics in order to figure out what has possibly happened and preventing it from happening again.
Here's a list of things worth checking:
Also, always keep this is mind:
Hope this helps!