Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
My server's been hacked EMERGENCY

A friend is experiencing a random redirect to an RU domain for two of her websites, along with a malicious cookie attack, as per a Norton pop-up everytime I load a page on her site.

I checked out her WordPress installation and I saw a suspicious plugin which I deleted, and I also cleaned up the .htaccess files which were clearly compromised with these Russian redirects.

However, even after ensuring all .htaccess files were clean, the site is still redirecting.

Any idea what I can do to diagnose, and rid the server of these issues, short of a fresh WordPress installation?

share|improve this question

marked as duplicate by EEAA, mgorven, Iain Jun 12 '12 at 8:44

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

↓ Click the Pretty Cloud! ↓

Nuke it from orbit!

↑ You'll Like It!! ↑

share|improve this answer
I concur, good doctor. Once a system is compromised, 99% of the time it's best to just nuke it. – Hyppy Jun 12 '12 at 17:56

Even if you manage to stop it redirecting, how are you ever going to trust it 100% again? Maybe there's other code that isn't as obvious, maybe it's stealing login credentials, maybe it's using the site to launch XSS attacks elsewhere, maybe they've popped an exploitable copy of tom_thumb.php onto the server and are using it to attack other sites.

The following is the standard answer for these kinds of questions,

My server's been hacked EMERGENCY

and I would ask you to seriously consider how you're going to trust the site without starting with a fresh install.

share|improve this answer

There is always the possibility of putting a second installation on the server (same version required) and diffing it against the damaged install. This should give you plenty of information on what was changed ... if you, however, have reason to suspect that root access has been gained to the server itself, do not trust it nor any passwords (ssh keys are OK) that have been used to authenticate against it.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.