Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
My server's been hacked EMERGENCY


My site has been hacked. The pages served to regular users are ok, but the pages served to bots (like google and facebook) are spammy.

the thing is it's not the whole site, just certain pages, like this:,mod=10&sourceid=chrome&ie=UTF-8

where do i start?

running drupal 6 site, under lamp on ubuntu

share|improve this question

marked as duplicate by David Schwartz, dunxd, Tom O'Connor, squillman, EEAA Aug 6 '12 at 12:12

This question was marked as an exact duplicate of an existing question.

Since your site has been compromised, you do not know what has been done to your server beyond what you can already see. So best bet is to learn from your mistakes and start again from a known good point. Whether you keep the existing site/server up while you do this depends on your particular circumstances.

Build a new server, reinstall the site assets from a recent (pre exploit) backup to the new server. Harden the site and server against known exploits. Decommission the old web server and replace with the new.

Read My server's been hacked EMERGENCY

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.