Website hacked !!! A lesson to Newbies!!!
- Thread starter bullseye123
- Start date
- Status
I hope you took a backup now that you have it restored.
While there may be plugins, here's how to do it manually:
Get FTP access and SSH access to your site.
SSH and run this command line backup:
mysqldump --add-drop-table -u mysql_username -p mysql_database > backupfilename_mm.dd.yy.sql
Then
FTP all the files from your site (plus the database backup,) down to your local machine.
If you ever need to restore the database, you can use this command:
mysql mysql_database < backupfilename_mm.dd.yy.sql
While there may be plugins, here's how to do it manually:
Get FTP access and SSH access to your site.
SSH and run this command line backup:
mysqldump --add-drop-table -u mysql_username -p mysql_database > backupfilename_mm.dd.yy.sql
Then
FTP all the files from your site (plus the database backup,) down to your local machine.
If you ever need to restore the database, you can use this command:
mysql mysql_database < backupfilename_mm.dd.yy.sql
bullseye123
Regular Member
- May 4, 2010
- 290
- 128
Thx Beerman,
I Downloaded every single file. lol and the Database to make sure I have everything.
Your Command's will come in handy, as Im sure that Backups Must be made more often. so will download a copy every week. or as more data is added I will Download the Database Daily.
Thank You, and Im sure there is a lot of us that can use this.
I Downloaded every single file. lol and the Database to make sure I have everything.
Your Command's will come in handy, as Im sure that Backups Must be made more often. so will download a copy every week. or as more data is added I will Download the Database Daily.
Thank You, and Im sure there is a lot of us that can use this.
While we're on the topic of command line backups, here's how to zip your whole site up as well:
After you SSH in, from your root directory run this:
tar -zcvf yourdomain.com_mm.dd.yyyy.tar.gz public_html
This will zip your whole site into one file, so you only need to backup two files then, your database file and your site file.
After you SSH in, from your root directory run this:
tar -zcvf yourdomain.com_mm.dd.yyyy.tar.gz public_html
This will zip your whole site into one file, so you only need to backup two files then, your database file and your site file.
ronstylistic386
Junior Member
- Mar 28, 2011
- 198
- 371
Bottom Line
Make your you have a back up files..
Make your you have a back up files..
- Feb 15, 2011
- 598
- 99
Recover it! ASAP
One of my sites, a PR3, was hacked recently and I didn't find out until Google had marked it as compromised in the SERPS. Someone stole my FTP password and used my site to host hundreds of backlinks.
I wish I had a lesson to give but the only one I can think of is don't use a cheap web host. Reason being, this hack has happened to others across multiple hosts, regardless of what website software they are running, and they all report someone has stolen their FTP password. Naturally my host said someone must have sniffed out my password, but this has the fingerprint of an unknown backdoor that someone is probably using by signing up to the same shared host and hacking into the accounts. Not sure if it's a system hack or maybe a control panel hack of some sort. But cheap hosts don't care and don't have the time/talent to investigate.
Had I logged into Google Webmaster Tools more frequently I might have noticed this sooner but now I'm on a long waiting list for reinclusion.
I wish I had a lesson to give but the only one I can think of is don't use a cheap web host. Reason being, this hack has happened to others across multiple hosts, regardless of what website software they are running, and they all report someone has stolen their FTP password. Naturally my host said someone must have sniffed out my password, but this has the fingerprint of an unknown backdoor that someone is probably using by signing up to the same shared host and hacking into the accounts. Not sure if it's a system hack or maybe a control panel hack of some sort. But cheap hosts don't care and don't have the time/talent to investigate.
Had I logged into Google Webmaster Tools more frequently I might have noticed this sooner but now I'm on a long waiting list for reinclusion.
bullseye123
Regular Member
- May 4, 2010
- 290
- 128
The following files were found on my site that was the culprit files : demons.php ; ezsy.php ; korengal.old.php ..
Then also if you check the 2 folders on your website. .log and . logs
These 2 folders are fulllllll of downloaded shit . all html files.
I resubmitted to Google, and Immediately the day after actually today. 13/05/2011 It is back on and running like always.
Then also if you check the 2 folders on your website. .log and . logs
These 2 folders are fulllllll of downloaded shit . all html files.
I resubmitted to Google, and Immediately the day after actually today. 13/05/2011 It is back on and running like always.
Glad to hear it all turned out well!, If you're absolutely positive you didn't install any rogue wordpress plugins and there's nothing OTHER THAN WORDPRESS in your public_html then it could be the host themselves. You did say it was a host out of some foreign country so it may not be up to date, so to speak, when it comes to security of their boxes so that's another thing I'd be worried about...see if any of their other clients have had similar problems. Another possibility is someone dropped a db of some random forum you joined years ago and used the password you signed up with, with the email you signed up and logged into your email, password re-usage is a HUGE factor in these attacks and seems to be the most likely as there were shells on the server sounds like and your host mentioned ftp credentials...
In any event change your passwords for wordpress, email, FTP, MySQL, and any other access you have to the host and to get rid of the malicious iframe by going into your theme folder (or wp-admin panel->theme->theme_editor) and checking the corresponding files (footer.php, header.php, etc.) for the code and get back out there, you can do much better than 5$/day believe me
and as you said backups are a bit of an inconvenience but they CAN be automated to make it much easier, be sure to set this up as soon as possible.
In any event change your passwords for wordpress, email, FTP, MySQL, and any other access you have to the host and to get rid of the malicious iframe by going into your theme folder (or wp-admin panel->theme->theme_editor) and checking the corresponding files (footer.php, header.php, etc.) for the code and get back out there, you can do much better than 5$/day believe me
and as you said backups are a bit of an inconvenience but they CAN be automated to make it much easier, be sure to set this up as soon as possible.
bullseye123
Regular Member
- May 4, 2010
- 290
- 128
As I told Jennifer,
I had 2 other website's that was hacked about a month ago, But nothing searious, it was simple HTML stuff, But I completely forgot about it before writeing this post, so Im sure that It might have been a Host problem.
Im now keeping a stricked eye on everything and If I have more problems, a Host change is most likely the best thing.
I had 2 other website's that was hacked about a month ago, But nothing searious, it was simple HTML stuff, But I completely forgot about it before writeing this post, so Im sure that It might have been a Host problem.
Im now keeping a stricked eye on everything and If I have more problems, a Host change is most likely the best thing.
Glad to hear it all turned out well!, If you're absolutely positive you didn't install any rogue wordpress plugins and there's nothing OTHER THAN WORDPRESS in your public_html then it could be the host themselves. You did say it was a host out of some foreign country so it may not be up to date, so to speak, when it comes to security of their boxes so that's another thing I'd be worried about...see if any of their other clients have had similar problems. Another possibility is someone dropped a db of some random forum you joined years ago and used the password you signed up with, with the email you signed up and logged into your email, password re-usage is a HUGE factor in these attacks and seems to be the most likely as there were shells on the server sounds like and your host mentioned ftp credentials...
In any event change your passwords for wordpress, email, FTP, MySQL, and any other access you have to the host and to get rid of the malicious iframe by going into your theme folder (or wp-admin panel->theme->theme_editor) and checking the corresponding files (footer.php, header.php, etc.) for the code and get back out there, you can do much better than 5$/day believe me
and as you said backups are a bit of an inconvenience but they CAN be automated to make it much easier, be sure to set this up as soon as possible.
- Status