My site has been hacked :(

anti_dote

anti_dote

Supreme Member
Joined
Dec 20, 2009
Messages
1,375
Reaction score
356
Wow I need help my site has been hacked, I have lost the admin password and ALT email.

it says this error
"$ Hacked by ghost-dz
$ Osm Dz Attack"

when i ran a scan on Sucuri Site check this is what I found

Code: 
Web site defaced. 
Details: [URL]http://sucuri.net/malware/entry/MW:DEFACED:01[/URL]
<title>Hacked by ghost-dz</title>

Please can someone help me I am using this site as my final year project at my college :( WTF
 
Advertise on BHW
DZ hackers are under your bed now ??am sorry for you , hope someone solve your issue soon !!Is this a wp blog by the way ??
 
BlackTagine said:
DZ hackers are under your bed now ??am sorry for you , hope someone solve your issue soon !!Is this a wp blog by the way ??
Click to expand...


Yup, basically the site is there I mean all my pages are there but there were few pages that were never filled those empty pages gives this error, beside I lost my Admin password and Editor password.

Damn I wish I would have a taken a backup earlier(clean one) but duh.
 
I found this email from wordpress firewall my website is still up
but don't know what will happen soon !

WordPress Firewall has detected and blocked a potential attack!

Web Page: $offending_url
Warning: URL may contain dangerous content!

Offending IP: 178.137.166.209 - http://ip-lookup.net/?ip=178.137.166.209
Offending Parameter: $_FILE = index.bak.php

This may be a "Executable File Upload Attack."

Can any one say what this file "index.bak.php" if it's uploaded in my server ???
 
BlackTagine said:
I found this email from wordpress firewall my website is still up
but don't know what will happen soon !

WordPress Firewall has detected and blocked a potential attack!

Web Page: $offending_url
Warning: URL may contain dangerous content!

Offending IP: 178.137.166.209 - http://ip-lookup.net/?ip=178.137.166.209
Offending Parameter: $_FILE = index.bak.php

This may be a "Executable File Upload Attack."

Can any one say what this file "index.bak.php" if it's uploaded in my server ???
Click to expand...


That could be some type of silent install....
 
Your hosting company seems to be sleeping !!!
 
I have sent an email to hosting providers but I guess those suckers are sleeping, plus I do not believe that they can do something :( am I Doomed ? :(:(
 
I just got that too.

BlackTagine said:
I found this email from wordpress firewall my website is still up
but don't know what will happen soon !

WordPress Firewall has detected and blocked a potential attack!

Web Page: $offending_url
Warning: URL may contain dangerous content!

Offending IP: 178.137.166.209 - http://ip-lookup.net/?ip=178.137.166.209
Offending Parameter: $_FILE = index.bak.php

This may be a "Executable File Upload Attack."

Can any one say what this file "index.bak.php" if it's uploaded in my server ???
Click to expand...
 
Last edited:
if your website is wordpress, try to re install wordpress.. or go to your ftp main root of the website. erase all you have uploaded and check if it is still hack. if not re upload all file you have upload from the start.

if does this not word contact you webhost provider to fix the issues
 
This is probably a good time for everyone reading to backup everything they have.

Personally I can't sleep at night if I don't have at least a backup folder on my hard drive and another backup folder on my external hard drive. For stuff like my main accounts/passwords I keep that on good old fashioned paper tucked away nicely, but I'm what most people call paranoid.
 
Yup are right that how you can do this damage control, for the record yes I had to uninstall the Wordpress installation and created the website again from scratch and this time took the backs ups, so if you wish to avoid any such incident create your backups.


mark27 said:
This is probably a good time for everyone reading to backup everything they have.

Personally I can't sleep at night if I don't have at least a backup folder on my hard drive and another backup folder on my external hard drive. For stuff like my main accounts/passwords I keep that on good old fashioned paper tucked away nicely, but I'm what most people call paranoid.
Click to expand...
 
anyone have any plugins that they recommend to prevent these things?
 
everythingred said:
anyone have any plugins that they recommend to prevent these things?
Click to expand...

- ultimate-security-checker.

Other plugins to use to stop/delay hacking attempts to your site:
login-lockdown - will allow only 3 failed attempts before locking the site for 15 minutes before allowing login again.
secure-wordpress - will add empty index.php file into all directories to prevent browsing

Some of the basic things you could do yourself:
1. EVERY directory (Including images, upload, download etc) should have an empty index.php file - without this empty file people can browse and see what is inside those directories (secure-wordpress will assist in this task)
2. By default Wordpress installation offer "admin" as the login ID - So if you use "admin" as the default login, the hackers already got your UserID - now they only need to run a hacking script against your site to crack the password!
3. The default prefix for databases is the first 8 characters of your domain name - Again the hackers already got the first part and to figure out the rest is childs play for them! (This and more is addressed by the ultimate-security-checker plugin)

So download and install the ultimate-security-checker plugin plus the other 2 suggested
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top