My site was HACKED today. I need URGENT help!

Discussion in 'Site & Server Administration' started by Proximity, May 20, 2008.

  1. #1
    Today when i logged into my site, it redirected me to:
    http://vhz.vn
    Code (markup):
    I tried looking around the files to make it right again, then i found in my index.php this code:

    header( 'Location: http://vhz.vn' ) ;
    Code (markup):
    I removed it, and now it works fine again.

    Now i want to know how to make this script secure because this can cause me alot of problems. I need urgent help because if they hacked it once they can hack it again.

    Let me know how they changed the index.php and what i can do to secure my server/files.

    Thanks.
     
    Proximity, May 20, 2008 IP
  2. kmzeron

    kmzeron Well-Known Member

    Messages:
    734
    Likes Received:
    40
    Best Answers:
    0
    Trophy Points:
    128
    #2
    What script are you using ?
     
    kmzeron, May 20, 2008 IP
  3. phplife

    phplife Peon

    Messages:
    36
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Do you have more than one script running on your server. It might not be the one you think or was attacked. If you have more than 1 script, do a G. search and see if there are any security warnings.

    phplife
     
    phplife, May 20, 2008 IP
  4. kmzeron

    kmzeron Well-Known Member

    Messages:
    734
    Likes Received:
    40
    Best Answers:
    0
    Trophy Points:
    128
    #4
    Maybe they hacked all entire server.
    Maybe you don't use any php scripts with vulnerability but maybe other sites from your server are using.
    That can be a php injection.
     
    kmzeron, May 20, 2008 IP
  5. Proximity

    Proximity Banned

    Messages:
    3,930
    Likes Received:
    35
    Best Answers:
    0
    Trophy Points:
    0
    #5
    They didnt hack the entire server just the index page i guess.

    I am using Mega File Hosting Script 1.2, i also left a message for the owner of the script.

    How can this be fixed?
     
    Proximity, May 20, 2008 IP
  6. kmzeron

    kmzeron Well-Known Member

    Messages:
    734
    Likes Received:
    40
    Best Answers:
    0
    Trophy Points:
    128
    #6
    Check this : THE URL WAS REMOVED FROM SECURITY REASON

    Maybe that is the problem.
     
    kmzeron, May 20, 2008 IP
  7. Proximity

    Proximity Banned

    Messages:
    3,930
    Likes Received:
    35
    Best Answers:
    0
    Trophy Points:
    0
    #7
    That was one of the problem, which seems to be fixed now. (I am contacting the owner aswell, this is a waste of my money, and can cause me more loss)
     
    Proximity, May 20, 2008 IP
  8. kmzeron

    kmzeron Well-Known Member

    Messages:
    734
    Likes Received:
    40
    Best Answers:
    0
    Trophy Points:
    128
    #8
    Ok take care.
     
    kmzeron, May 20, 2008 IP
  9. phplife

    phplife Peon

    Messages:
    36
    Likes Received:
    1
    Best Answers:
    0
    Trophy Points:
    0
    #9
    Is you site still live or have you temporarily blocked access to this script and/or your site. You may want to backup your databases and also contact your host to make sure they have a recent backup. Bad things have been known to happen with hosts and backups.

    phplife
     
    phplife, May 20, 2008 IP