Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

Help!

My site has been hacked. The pages served to regular users are ok, but the pages served to bots (like google and facebook) are spammy.

the thing is it's not the whole site, just certain pages, like this:

https://www.google.com/search?q=www.radicalislam.org%2Fanalysis%2Fwhen-criticizing-religion-read-islam-becomes-us-criminal-offense&sugexp=chrome,mod=10&sourceid=chrome&ie=UTF-8

where do i start?

running drupal 6 site, under lamp on ubuntu

share|improve this question

marked as duplicate by David Schwartz, dunxd, Tom O'Connor, squillman, EEAA Aug 6 '12 at 12:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1 Answer 1

Since your site has been compromised, you do not know what has been done to your server beyond what you can already see. So best bet is to learn from your mistakes and start again from a known good point. Whether you keep the existing site/server up while you do this depends on your particular circumstances.

Build a new server, reinstall the site assets from a recent (pre exploit) backup to the new server. Harden the site and server against known exploits. Decommission the old web server and replace with the new.

Read My server's been hacked EMERGENCY

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.