Possible Duplicate:
My server's been hacked EMERGENCY


My site has been hacked. The pages served to regular users are ok, but the pages served to bots (like google and facebook) are spammy.

the thing is it's not the whole site, just certain pages, like this:


where do i start?

running drupal 6 site, under lamp on ubuntu

marked as duplicate by David Schwartz, dunxd, Tom O'Connor, squillman, EEAA Aug 6 '12 at 12:12

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


Since your site has been compromised, you do not know what has been done to your server beyond what you can already see. So best bet is to learn from your mistakes and start again from a known good point. Whether you keep the existing site/server up while you do this depends on your particular circumstances.

Build a new server, reinstall the site assets from a recent (pre exploit) backup to the new server. Harden the site and server against known exploits. Decommission the old web server and replace with the new.

Read How do I deal with a compromised server?

Not the answer you're looking for? Browse other questions tagged or ask your own question.