-1

My website was recently hacked that apparently it came under code injection vulnerability not SQL injection. At least that's what Google is telling me and even gave me a possible iframe codes. That was a shock to me for it never happened to my websites. I found out that I recently was testing upload php script on my webserver and forgot to delete it afterward. So, I knew how they got in. So, I went ahead and deteled everything and anything that I saw didn't belong in the server including the upload php script. Plus, I saw some wierd stuff in the .htaccess file. Instead of checking the code, I completly deleted it from the server.

Anyways, I tried to do everything I can as people have suggested online. Still, the hack didn't go away completely and it still isn't. So, I decided enough is enough. I found another webhoster and moved my website there. I uploaded my backed up files not the files from the previous hosting server for my website. Repointed my domain name to my new webhosters server by changing my nameservers. Well, after doing all that I thought I was home free. It turns out I am not out of the woods. To my surprise, my website still considered to be harmful and dangerous. I visited my website by entering mywebsite.com into the browswer and it was clean.

However, when I entered www.mywebsite.com, the browswer came back and said my website is considered to be hacked and reporting it as attack site, but when I clicked on "ignore this warning" it took me to my the new webserver. I was dumbfounded. I thought the domain name was pointing at my old webserver, but it was not.

How is it possible for something like that to happen especially when I am on a new server and uninfected files?

I am starting to run out of options and getting frustrated over this. I am loosing regular visitors. Please, help....I just want to get my domain back.

if anyone interested, my website domain is:

goody-games.com is clean.

www.goody-games.com is reported an attack site.

PS: I have already scanned my website through sites like Sucuri.com and they all say my website is clean, but I am still not sure.

What can I do at this time? Any help will be greatly appreciated.

ThN
  • 99
  • 3
  • So did you try following Google's instructions to use their webmaster tools to get them to re-check the site? Incidentally, if you're not sure what parts of your site code are "clean" and which are not, and you're not sure what happened, then restoring possibly compromised backups is not the way to clean things up. – Rob Moir Jul 30 '12 at 21:25
  • If your system has been compromised then you need to format, re-install from trusted sources, restore your data, correct the issues. You should do this all before your bring the system back online. – Zoredache Jul 30 '12 at 22:17
  • http://serverfault.com/questions/218005/my-servers-been-hacked-emergency – Zoredache Jul 30 '12 at 22:24

3 Answers3

2

goody-games.com and www.goody-games.com return identical content for the home page.

If you're sure all the malicious code is cleaned out, you can resubmit your site to Google for testing through Webmaster Tools.

Michael Hampton
  • 237,123
  • 42
  • 477
  • 940
  • Michale Hampton, Thank you. What I didn't realize was this. After I moved my website to a new webserver and repointing my nameserver, I had to resubmit my website to Google. Apparenty, browsers use Google website scanned information to determine if a site is a attack site or not. After I resumbitted my website last night right after I posted this question on serverfault, it is no longer considered a hack site. Now, my site is working. Yahooooooo!!! :) The only thing is now I have to go through my website and update it for all the changes I made right before it was attacked. ServerFault is cool – ThN Jul 31 '12 at 12:48
0

run security scan of your website using online available tools like Acunetix web vulnerability scanner, Nessus, or openVAS(Free). one of these scanners will tell you that which door is open in your site, which is allowing the hackers to attack it and inject code into it.

Fix all the vulnerabilities they tell you and your site would be secure from those code injections.

Hackers/bots are only exploiting any vulnerability present in your server, once you know that vulnerability, you can fix it and make your site safe from code injection.

Farhan
  • 4,210
  • 9
  • 47
  • 76
-1

As an information to anyone looking for ways to solve their hacked website problem. One of the way to find out if you have an strange code in your files is to open them in wordpad. Almost always it will show you everything. If it can't read it, it will still show you something. It might look like a weird or funny characters. After I restored my website, just for fun I ran through my infected files through wordpad. At the end of each and every files were these hexadecimal characters which it couldn't read. However, in place of that it had squares and funny faces and others. So, I knew that must be the hack php code.

I thought, I give you little bit of info if you are in a middle of a situation like this.

ThN
  • 99
  • 3
  • Looking for "weird or funny characters" in files is not a good, scalable or reliable way to search for malware. – Rob Moir Aug 02 '12 at 17:51
  • @DJPon3, But it is one of the way in which you can quickly locate if you have any malware in your files. It is true that it can exist in many forms and in many places in your server. In fact, many website had instructed their visitors to open their files in programs that can read hexidecimal characters. In otherward, there is no one sure way to fix your hacked website. But to down vote my answer as total nonsense doesn't mean my answer is not true. If you have a sure way to fix code injection 100%, please let me know for I have many websites and would like to prevent such attack in the future. – ThN Aug 03 '12 at 19:17
  • Don't get me wrong, I'm glad it worked for you, but claiming that looking through code for "hexadecimal characters" is a viable method of looking for malware is like claiming that buying lottery tickets is a viable way of investing for your retirement. As I said, I'm glad it worked for you... but you got lucky. – Rob Moir Aug 03 '12 at 21:05