Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Three days back my website ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided by Free Hostia. I contacted them, but they say they don't provide any "site script debugging service". How can I get my website back?

share|improve this question
    
This should be on webmasters.stackexchange.com, not here. OT. –  Brian Driscoll Feb 9 '11 at 5:13
    
You've got a JS/TrojanDownloader.Iframe.NJT on your site – according to ESET Smart Security. –  nyuszika7h Feb 9 '11 at 14:02
    
I too face the same problem, and am also hosted at freehostia, I thought maybe a competitor found a way to get it black listed... in this industry, I wouldn't put it past them. –  user21360 Jan 11 '13 at 6:01
add comment

migrated from stackoverflow.com Feb 9 '11 at 5:23

This question came from our site for professional and enthusiast programmers.

3 Answers

Your site currently has some malicious Javascript embedded in the bottom of your site that embeds an iframe in your page. This could infect visitors with malware, attempt to steal their passwords, or do all sorts of other nasty things.

There are a couple of steps you can take to remedy this problem.

Reinstall the latest version of WordPress

It's very important that you keep up to date with any web applications you're using on your web site. Older versions can contain security vulnerabilities that can be used to infect your page with foreign code or content.

Since it looks like your site is using WordPress, I'd recommend reinstalling the latest version and starting from a clean slate. You may lose any previous posts and/or comments, but you also don't want to carry along any of the infection with the previous content.

If you'd like to keep your current post, I would recommend copying them into a text file first, and them pasting them into the new installation as new entries. This way, you can make sure that no residual code is present.

Change your FTP Password

Often, attackers can get in to your web site if you have a weak FTP password. Additionally, if you don't use sFTP, your password is sent in clear text across the Internet and can be intercepted.

Using a strong password (more than eight characters, mixed with numbers and symbols, without any common words) and connecting through secure channels can help prevent this.

Clean out any unfamiliar files

Make sure to check your web root for any files you don't recognize. If your account has been compromised, attackers may leave a backdoor script as a method of re-compromising your site.

Check for any files with odd modification times - times that you wouldn't have uploaded files to your web site, for instance.

Consider changing hosting providers

If you're already following good security precautions, then you might not be at fault. If FreeHostia is running server software that contains a vulnerability, or they don't follow security practices themselves, there is nothing you can do to secure your web site. Make sure to host your web site with a reputable host.

share|improve this answer
2  
Good answer. I'd also like to add, be very careful where you install WordPress themes and plugins from. See: wpmu.org/… –  aendrew Feb 9 '11 at 21:21
add comment

You're using WordPress and haven't updated, your source says 2.8.2.

At the bottom of your page is a script. eval(unescape('%64 ...

Check your theme files and the database, check the WordPress files or maybe try a clean install and restore the database.

Searching 'wordpress eval 64' has lots of results but pretty much you have to clean your files of that. It could just be the footer of your theme though.

Here's a link, http://wordpress.org/support/topic/evalbase64_decode-hacked, to the WordPress forums with links and help.

share|improve this answer
add comment

You apparently have a security vulnerability in your code.

You need to fix the vulnerability and remove all traces of the attack from your database and/or files.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.