Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
My server’s been hacked EMERGENCY

My website was hacked recently. I think i've found the code that was added to the htaccess file, deleted it and then added script to prevent the htaccess file being accessed again. I've also deleted the php file that the hacked code refers to (common.php). What do i need to do next? I'm not a programmer or website developer but i really wanted to see if i could fix the problem myself as i've spent quite a few hours trying and don't give up easily.

Here is the hacked code that i deleted:

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} (google|yahoo) [OR]
RewriteCond %{HTTP_REFERER} (google|yahoo)
RewriteCond %{REQUEST_URI} /$ [OR]
RewriteCond %{REQUEST_FILENAME} (shtml|html|htm|php|xml|phtml|asp|aspx)$ [NC] 
RewriteCond %{REQUEST_FILENAME} !common.php
RewriteCond /home/httpd/vhosts/ -f
RewriteRule ^.*$    /common.php [L]

this code has to stay in the htaccess file as it redirects my url to seo friendly ones or the website errors, but has this code been hacked as well?

# Apache search queries statistic module
RewriteEngine On
AddHandler php5-fastcgi .php .php5
# <contrexx>
#   <core_modules__alias>
    RewriteRule ^about-us$    /index.php?page=883 [L,NC]
    RewriteRule ^ausfluge-und-aktivitaten$    /index.php?page=800 [L,NC]
    RewriteRule ^bluestardive-news$    /index.php?page=919 [L,NC]
    RewriteRule ^bookings$    /index.php?page=911 [L,NC]
    RewriteRule ^diveresort$    /index.php?page=879 [L,NC]
    RewriteRule ^diving$    /index.php?page=880 [L,NC]
    RewriteRule ^excursions-and-activities$    /index.php?page=881 [L,NC]
    RewriteRule ^galerie$    /index.php?section=gallery [L,NC]
    RewriteRule ^oceannight$ [L,NC]
    RewriteRule ^philosophy$    /index.php?page=846 [L,NC]
    RewriteRule ^reservation$    /index.php?page=917 [L,NC]
    RewriteRule ^reservierung$    /index.php?page=918 [L,NC]
    RewriteRule ^resort$    /index.php?page=798 [L,NC]
#   </core_modules__alias>
# </contrexx>
share|improve this question

migrated from Oct 21 '12 at 9:59

This question came from our site for professional and enthusiast programmers.

marked as duplicate by Iain Oct 21 '12 at 11:15

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

...did you find out how they got in? If not, they'll probably just set up shop again soon. – nneonneo Oct 21 '12 at 5:26
If you have a dedicated host then you should talk to them to see how and where from the attackers got entry. This has happened to me as well, and my website got flagged as malicious by Google, making it impossible to enter it from searching it on Google. Check out for tips that might help you cleanse whatever corruption that has been made. – Simon Carlson Oct 21 '12 at 5:44
i know it was one of two people that did it...we had a manager that was renting the resort until he got bored, he left the other week and left me with loads of issues to sort out he had server access..the other person was a guest and this manager aggrevated him so he could have hacked into the site... – user1762595 Oct 21 '12 at 5:45
contrexx have reset all the access codes and deleted the manager's access...if it was the guest that was the hacker will putting code in the htaccess file so that noone can edit it not prevent anyone from hacking the website? – user1762595 Oct 21 '12 at 5:47

The best thing to do in situations like these is to pinpoint the users entry point, and duplicate the attack - I cannot tell you whether there is any thing suspicious added into the .htaccess as I have no idea what is inside of index.php.

If index.php echo's data directly from the database, then it might be possible that he/she added malicious code inside the database, he/she possibly created a few new entry points (PHP Shells, Vulns) in other files.

I would strongly recommend you to talk to a security professional - if not, thoroughly re-inspect every file on your server, including database entries.

Make sure to figure out what his entry point was as well, to prevent future attacks - if you need any further information you can always contact me.

share|improve this answer
Hi Jimmy, the entry date on the htaccess file and the index page were the same, both were dates in the past when the website was fine...i think it's likely the index.php file got hacked...How do i edit php files? when i open it up it's just a mishmash of digits. I tried deleting the index.php file but it just crashed the website. – user1762595 Oct 21 '12 at 5:51
Are you running any CMS - or did you write your website yourself? Also; could you post the index.php here? Is that the only file on your server? – Jimmy van Beele Oct 21 '12 at 6:00
we use the contrexx cms and the website was designed by a compnay...i've been editing the htaccess through the ftp – user1762595 Oct 21 '12 at 6:04
What version of contrexx are you using? – Jimmy van Beele Oct 21 '12 at 6:05
Contrexx® Web Content Management System Standard Version 2.1 Service Pack 3 - Stable Release date: 23.01.2010 – user1762595 Oct 21 '12 at 6:10