I think My Site was Hacked! How Do I fix it?

Discussion in 'Site & Server Administration' started by Keyblast, Oct 20, 2010.

  1. #1
    Hello all:

    I have a number of websites spread out across a couple of different hosting accounts (bluehost and hostgator). This morning I woke up to find quite a large number of my websites have been deindexed from Google. Some of these sites are a couple of years old and I have not changed anything on them for a while; and I believe everything is in compliance with Google's webmaster guidelines.

    Also, all of my hostgator websites are fine (still indexed); which leads me to believe that somehow my bluehost account was hacked (keylogger perhaps?) and these sites were compromised.

    So, my main question is: How do I find out what was done to my sites? I have been trying to find hidden links, etc; but this is not really my expertise. What do you recommend to find out if my sites have been hacked and what has been done?

    Is there a service I can use to clean up my sites? Thanks!
     
    Keyblast, Oct 20, 2010 IP
  2. hostwebdata

    hostwebdata Peon

    Messages:
    264
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #2
    do you have any back up of your files, if you do you can replace the file and your should be good to go
     
    hostwebdata, Oct 20, 2010 IP
  3. madaboutlinux

    madaboutlinux Member

    Messages:
    250
    Likes Received:
    7
    Best Answers:
    2
    Trophy Points:
    43
    #3
    If you don't have root access to your server, you should better ask your host to figure out where the problem is since they can perform a wide range of investigation and quite quickly. BTW, are the websites hosted with Bluehost were on the same server OR on different servers? If they are on a same server, it is quite possible that the Shared IP, the websites are pointing to, is somehow blacklisted and causing issues to all the websites resolving to it. If you have root access to your server, have someone from your hosting provider OR a Server Admin to look into it for you.
     
    madaboutlinux, Oct 22, 2010 IP
  4. AllWebSolution

    AllWebSolution Peon

    Messages:
    6
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #4
    I think if everything is looking fine on your website then hacking is not reason because generally now a days i am watching that if any one hack your site then he will change your index page to redirect traffics or any other reason. There can be one more reason of hits and update because if you are not updating your website and limited users come to your site then it can be reason of deindexing.

    I have been faced hacking problem once but due to backup everything is fine now and so i am saying that after hacking hacker will change at least website index page (In my case and saw also in some other sites).

    Please describe briefly if hacking can deindex website because related knowledge is must for webmaster like me.

    Thanks
     
    AllWebSolution, Oct 22, 2010 IP
  5. shichemt

    shichemt Active Member

    Messages:
    44
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    61
    #5
    Backup Your files and setup an antivirus like Kaspersky 2011
    it seems to be good , cuz it built in a anti-keylogger too :)
     
    shichemt, Oct 23, 2010 IP
  6. rllunzmann

    rllunzmann Active Member

    Messages:
    1,796
    Likes Received:
    9
    Best Answers:
    0
    Trophy Points:
    80
    #6
    Your host(s) should also be able to easily check the RAW access logs too if you feel your account was breached. They can also setup security on that specific port for your public IP. Depending upon your ISP, that could be the easiest solution but almost all ISP's issue dynamic IP's which change overtime or if your modem/router is restarted.
     
    rllunzmann, Oct 25, 2010 IP
  7. JeezMGeez

    JeezMGeez Member

    Messages:
    30
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    41
    #7
    Speaking to the host should be first point of call
     
    JeezMGeez, Oct 26, 2010 IP