I was hacked recently. The hack seems to redirect any site on my server to a fake virus site. So I deleted all my website files and the hack seemed to go away. About a week later, it's back -- the same one. I never deleted my databases, but also never uploaded the websites that used them. Is it possible for the databases alone, without any website linked to them, to be somehow supporting the hack?
A database SERVER can host a hack, or a database can too, if the database server is set to execute something (like a procedure/script in the DB).
In truth, anything that can execute code and has some (tiny) memory space can host a hack. There have been cases of people hacking networks via a postscript printer, since postscript is a turing-complete language.
In your case though, it sounds to me like something much more commonplace is going on than a database hack. Don't just delete files on your site -- that's just deleting evidence of the crime. It's like sweeping away the bodies of friends when someone shoots them, and expecting no more freinds to get shot. What you have to do is look at the bodies, question who they are, how where they killed, who would want to kill them, how did they do it, and how you can stop them.
You'll need to examine any web scripts you're using. Learn about web security and check any code you wrote is secure; learn about the webapps you've installed, and check you have the latest versions, and that new versions come out whenever security problems are reported. If new versions don't come out to fix problems, then delete the app and NEVER install it again; find a better alternative.
Also, make sure your operating system is up to date (windows update etc.), that you have antivirus installed and up to date, a working, properly configured, secure, up to date firewall, etc.
did you actually found and protected yourself against cause of the attack [ eg hole in cms / forum / whatever other webapp you had ]?
probably hacker left backdoor on your system for her/him-self and it's on lower level then web application.
regarding your question - yes and no - it all depends what kind of information is kept in the DB. if you have some scripted webapp that stores [ for some reason ] executable code [ eg plugins code ] in the database - then surly some backdoor could be left there. even if that is not the case - mabye you have templates stored in db - then for instance xss attack could be repeated against you even if you restored everything else.
To add to what others have said already. The DB can 'host' an hack but it's probably more likely that the OS is infected and not your DB.
Generally speaking however, once your host is infected, it's best to remove the server from the internet, forensically investigate the incident and rebuild the server, not just remove files and hope you got them all.
I think in order for anyone to answer your question accurately more information is needed. Specifically, if one assumes you removed ALL websites from your server, the first question that springs to mind based on your database fears is: can your database server be reached over the Internet?
i.e. is it listening on a public IP? A quick
netstat -nuptl should give you this info.
Further, just taking your website content offline does not mean your webserver isn't still available, nor for that matter a host of other networked applications. You need to be aware of everything your system is exposing on the network.
Also, as others have said, when you do not know where the intrusion came from, your best bet is to re-install from the bare metal up: OS, libraries, applications, services, etc. Otherwise you'll spend valuable time running around looking for any possible exploit.
Once you've rebuilt using the latest patches for as much as is possible without causing dependency issues, strip out services not needed, or have them plugged into a Unix socket where possible, instead of a TCP one. And seriously consider some form of IDS. There are many available, but a simple one is AIDE, which works in the same manner as Tripwire - checking for file system changes against a database it compiles.
PS: Backup, backup, backup, and good luck.
You are talking about a crack as if it was a virus, than works from inside the system on it's own. There is a possibility that a virus was used to crack your site, but most likely it was cracked from the outside.
Restoring your website files only removed the result of the crack, not the security hole that allowed it to be done. That's why it could be repeated the next week, and that's why it will continue to happen until you fix it.
If you don't HTML encode text that you write to the web page, a client script can be executed and gather information, like for example a cooke value authenticating your administrative login.
If you don't encode string values correctly when you create SQL queries, a value can alter your query to return a different result, or it can contain another query that can change data in your database.