1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

[HELP] Hacked website or?

Discussion in 'BlackHat Lounge' started by psyclogic, Jun 10, 2015.

  1. psyclogic

    psyclogic Regular Member

    Joined:
    Jul 22, 2012
    Messages:
    283
    Likes Received:
    96
    Guys i've been under constant attack last month or so.
    I see a lot of pages on google from my site, porn page links that are installed in my website and cannot clean them. I also got notification from google webmaster tools for suspicious activity.
    Does anyone have idea what is this?

    [​IMG]

    I got hit by 11k porn backlinks and all those pages like in the image above. I wonder is it plugin infection or the site has been hacked completely...

    Thanks in advance
     
    • Thanks Thanks x 1
  2. Repulsor

    Repulsor Power Member

    Joined:
    Jun 11, 2013
    Messages:
    766
    Likes Received:
    275
    Location:
    PHP Scripting ;)
    Wow. That looks like a rootkit or something that is within your site already and doing its work from the inside. Go through all files for malicious codes. Remove all unwanted,untrustable plugins. Delete any nulled plugins and themes. Clean the remaining files.
     
    • Thanks Thanks x 2
  3. Setox

    Setox Regular Member

    Joined:
    Apr 30, 2015
    Messages:
    340
    Likes Received:
    115
    Location:
    /public_html
    i think it depend on you to find how your site got spammed with all theses backlinks . do as Repulsor said & see if this can save you ! LOL , i hope the best for you bro !.
     
    • Thanks Thanks x 1
  4. brucewayne90

    brucewayne90 Regular Member

    Joined:
    Dec 19, 2013
    Messages:
    350
    Likes Received:
    119
    Occupation:
    IM
    Location:
    Gotham City
    Woah. That's bad man. Screw them hackers man. OP you might want to check with these guys: https://sucuri.net/. See if they can help you out with this.
     
    • Thanks Thanks x 1
  5. Apricot

    Apricot Administrator Staff Member

    Joined:
    Mar 26, 2013
    Messages:
    12,563
    Likes Received:
    7,975
    Gender:
    Female
    Occupation:
    BHW Moderator
    Location:
    the clacks
    Home Page:
    I'm assuming you're using wordpress? There's been a rash of pharma hacks on them lately and the porn variant is pretty popular. If it's not wordpress and someone's managed to add html files to a directory, this is much easier to clean and fix.

    If it is wordpress then you need to look at the php files in the root and make sure the ones that should be there are the only ones there. The wordpress codex has a list of the files that should be there if you're not sure. If there are extras, like keyboard.php or auto.php then you've been infected.

    Clearing it out is not difficult but it is long-winded and you need to be very careful with it. Back it up, then google wordpress pharma hack - there's some good resources available that you can work through step by step. When you get it clean make sure you harden the install - again, lots of info in the codex.
     
    • Thanks Thanks x 1
  6. psyclogic

    psyclogic Regular Member

    Joined:
    Jul 22, 2012
    Messages:
    283
    Likes Received:
    96
    Thanks all for the help. Yes @MrApricot it's a wordpress site, thanks for leading me into the right direction...
     
  7. Apricot

    Apricot Administrator Staff Member

    Joined:
    Mar 26, 2013
    Messages:
    12,563
    Likes Received:
    7,975
    Gender:
    Female
    Occupation:
    BHW Moderator
    Location:
    the clacks
    Home Page:
    np - if you get stuck, post back and we'll see what we can do to help.