-1

Possible Duplicate:
My server's been hacked EMERGENCY

I'm going crazy right now and I don't know what to do.

I've did a Google search about those hackers where they using .htaccess to redirect my site to their site to gain traffic, and now I'm getting this problem since yesterday and I don't know what I should do....

I've also did a search and found some people having the same problem and the suggestion was to do a clean install for my site and I have done that.

My Wordpress site is to date as well as the plugins.

I check my permission all is good.

I have check the database everything is okay.

Password is changed and they still can do the same.

The .htaccess is being redirect to http://baidu.com but before that is actually redirecting to a .rus sites.

Any suggestion please :(

Community
  • 1
Ali
  • 300
  • 1
  • 4
  • 12
  • 2
    Do you control the server, or is it a shared hosting system? – Shane Madden Jun 10 '12 at 05:31
  • @ShaneMadden I've full control of the site. – Ali Jun 10 '12 at 05:34
  • @ErikA well as I mentioned above I did a research I did all those searches and my case is not solve yet and what shall I do that is why I'm asking for help to resolve this problem :( – Ali Jun 10 '12 at 05:34
  • @Ali Well, the access method isn't the htaccess file, it's something else. There is some good information in the answers on that question regarding checking over your logs and auditing your exposed services to find what method the attackers used to make their modifications. This attack seems to be more prevalent recently - does your htaccess match [this one](http://serverfault.com/q/396665/72586)? What kind of hosting service is this on? – Shane Madden Jun 10 '12 at 05:39
  • @ShaneMadden exactly the .htaccess I've is something like that. I'm on Mac OS X -- Xserve – Ali Jun 10 '12 at 05:41

2 Answers2

2

If they have access to modify your .htaccess file, then you've possibly got issues with compromised access starting with the computers you use to access the website for FTP and administration. Scan theses systems first for compromise, then change FTP and admin passwords on the website.

If it's still possible for them to change the .htaccess file at will, your Wordpress installation was probably outdated and offered a good backdoor into the system by bad scripts, a bad module or database code injection.

See Halfgaar's post to start finagling that out

Fiasco Labs
  • 563
  • 4
  • 10
1

Most sites host wordpress by having the php files writable for the webserver. I never liked that security issue. Probably they installed a PHP script somewhere.

You can download the sources of your hosting platform, download a fresh Wordpress and do a diff (linux: diff, windows: winmerge for instance). You can then see what code is different. Of course there'll be some, but you should be able to tell what code is illegitimate. It usually looks as obfuscated as possible, sometimes bas64 encoded in PHP.

Edit: something else you might want to try: php cgi bug. You can easily test if your server is susceptible.

Halfgaar
  • 7,921
  • 5
  • 42
  • 81