Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

My website was hacked, with the following code added to the end of the page:

<img heigth="1" width="1" border="0" 
    src="http://imgddd.net/t.php?id=########">

(The id had an 8 digit number in place of the ########)

The link didn't work. Also, the page would crash until I removed the link. What else do I need to be worried about? Why would hackers put such a poor link on a website?

share|improve this question
    
It is discussed here also: wordpress.org/support/topic/…. It seems it was an FTP hack of Filezilla. Can anyone confirm this? –  Ari May 3 '11 at 3:40
add comment

2 Answers

imgddd.net shows up on MalwareDomains.com's list (as of 4/26/2011) as a malware distributor; it appears as though the t.php script has been taken down, however, the main page remains active with what appears to be a Flash-based exploit; I'm not interested in seeing it in action, and would advise against testing it out yourself.

There are a variety of maliciously-crafted image file exploits in the wild - this was probably an attempt to launch one.

If your browser crashed, there is a possibility your machine was compromised by viewing the image file in question. Take appropriate precautions by scanning your machine for viruses, malware, and rootkits.

You will also need to audit your hosting account to determine how the malicious image link was added to your page - start by contacting your hosting provider.

share|improve this answer
add comment

It is not enough to simply delete that snippet of code. And this is not what you do first.

share|improve this answer
    
I didn't find a .log file, or notice any recent suspicious files either. Strange. –  Ari May 17 '11 at 5:12
    
@Ari, 1. the .log directory and other doorway files are not always being created on hacked sites 2. the .log directory and .php files can be created in some subdirectory of your site, so make sure to scan them all for suspicius content 3. I confirm that this hack uses stolen FTP passwords. –  Denis May 17 '11 at 10:19
    
and stop using FTP, start using SFTP –  MiPnamic May 18 '11 at 7:12
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.