Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This question already has an answer here:

Just recently we noticed in our website (which was made by a 3rd party before) that the database was compromised. All data was appended by a small html information. What we did is to change all the sql access to parameterized version and change the password to an encrypted one.

But today same thing happened again and our server now is unresponsive (I'm trying to connect using teamviewer). How can I sanitized our server and prevent this from happening again?

share|improve this question

marked as duplicate by EEAA, MDMarra, Michael Hampton, mdpc, Nic Mar 10 '13 at 6:16

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

up vote 2 down vote accepted
  1. Take the server offline

  2. Identify the cause of the breach (insecure code, unpatched web server, using FTP instead of SFTP, whatever).

  3. Restore the whole system from a known good backup while offline.

  4. Correct the cause of the breach (updated code, patched server, whatever).

  5. Bring the server back online.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.