1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Am I hacked?

Discussion in 'BlackHat Lounge' started by matrix79, Apr 1, 2015.

  1. matrix79

    matrix79 Junior Member

    Joined:
    Jan 20, 2013
    Messages:
    123
    Likes Received:
    27
    So I open my homepage - everything is great.
    I click through the link to my last post and... no content. Stuck? I try to reload page. No success. Tried second time and that's when it started to download something! I immediately cancelled the download.

    I can't find anything suspicious so far although I don't really know where to look. I couldn't replicate the issue again in different browsers or computers.

    No warnings in Google search results next to my links or in my GWT.

    I scanned with free Sucuri plugin and it says it's all clean.

    What should I do? Where to look for the problem?

    I never dealt with hacked websites but I am not technically challenged.

    Thanks in advance.
     
  2. Visit

    Visit Senior Member

    Joined:
    Mar 11, 2014
    Messages:
    840
    Likes Received:
    305
    Occupation:
    Porn Star
    Location:
    Where that Show The Broen is Located
    Home Page:
    I use wordfence, it can scan and show you how to fix the problem.
     
    • Thanks Thanks x 2
  3. jamie3000

    jamie3000 Supreme Member

    Joined:
    Jun 30, 2014
    Messages:
    1,372
    Likes Received:
    625
    Occupation:
    Finance coder looking for semi-retirement
    Location:
    uk
    Try emptying your cookies and see if it tries to download again
     
    • Thanks Thanks x 1
  4. matrix79

    matrix79 Junior Member

    Joined:
    Jan 20, 2013
    Messages:
    123
    Likes Received:
    27
    Wordfence didn't find anything either. And it doesn't do this anymore. Strange...
     
  5. ADLUDUM

    ADLUDUM Jr. VIP Jr. VIP

    Joined:
    Mar 30, 2013
    Messages:
    153
    Likes Received:
    45
    Home Page:
    Get MalwareBytes and Avast Security and do a scan :) and get PeerBlock.
     
  6. Inabox

    Inabox Newbie

    Joined:
    Aug 27, 2014
    Messages:
    44
    Likes Received:
    19
    Are you using a nulled theme or plugin? Or a theme or plugin you downloaded from a website that shares themes or plugins? If so, you need to redo your entire website, as 99% of nulled themes are infected.

    Run a scan on your computer, it could be something on your computer and not your actual website. Run malwarebytes, virus scan, and if anything pops up, run a deep root scan, that scans for viruses before your operating system loads (this will take probably 24 hours)

    If you have any toolbars, sketchy addons for chrome, disable them all. Clear your cookies/cache/flush dns, and see if you can replicate the error.

    If you have a VPS, see what your website looks like on there....if you dont have a VPS, find a free trial one and see what it looks like on there.
     
    • Thanks Thanks x 1
  7. herotest

    herotest Registered Member

    Joined:
    Mar 2, 2015
    Messages:
    96
    Likes Received:
    19
    Location:
    Unknown
    Clear your history and cash and check it
     
    • Thanks Thanks x 1
  8. matrix79

    matrix79 Junior Member

    Joined:
    Jan 20, 2013
    Messages:
    123
    Likes Received:
    27
    No, I don't use anything nulled. Complete system scan didn't find anything. I had Chrome addons but they are gone now. The site behaves normally. It only happened once but it still did happen!!! I wasn't hallucinating, were I :confused:

    Cleared cookies, history -- everything looks OK. Switched computers and browsers -- normal site. I could never replicate the issue.
     
  9. cthulchu

    cthulchu Newbie

    Joined:
    Aug 19, 2013
    Messages:
    16
    Likes Received:
    5
    Occupation:
    SEO specialist
    Location:
    127.0.0.1
    Home Page:
    hmm... Okay...

    It was one time glitch of the web-server. Wanna know what exactly it was? Read your browser and your web-server low-level logs. Don't wanna use logs? forget about it until the next encounter.

    No, site wasn't hacked, it's a normal issue. Yes, I'm sure. No, the file you were downloading was either the .html or .php file that a little confused web-server tried to give you.

    Cheer up!
    Have an ice cream.
     
    • Thanks Thanks x 1
  10. jamie3000

    jamie3000 Supreme Member

    Joined:
    Jun 30, 2014
    Messages:
    1,372
    Likes Received:
    625
    Occupation:
    Finance coder looking for semi-retirement
    Location:
    uk
    Apache could of had a weird moment and served you the page as a download I suppose, things like that can happen. I've had it just dump out php randomly instead of running it once
     
    • Thanks Thanks x 1