Three days back my website http://www.ganapatihegde.com has been hacked/attacked by some hacker. Now, when anyone tries to see my website, it says "Reported Attack Page!". I am using server provided by http://freehostia.com. I contacted them, but they say they don't provide any "site script debugging service". How can I get my website back?
migrated from stackoverflow.com Feb 9 '11 at 5:23
There are a couple of steps you can take to remedy this problem.
Reinstall the latest version of WordPress
It's very important that you keep up to date with any web applications you're using on your web site. Older versions can contain security vulnerabilities that can be used to infect your page with foreign code or content.
Since it looks like your site is using WordPress, I'd recommend reinstalling the latest version and starting from a clean slate. You may lose any previous posts and/or comments, but you also don't want to carry along any of the infection with the previous content.
If you'd like to keep your current post, I would recommend copying them into a text file first, and them pasting them into the new installation as new entries. This way, you can make sure that no residual code is present.
Change your FTP Password
Often, attackers can get in to your web site if you have a weak FTP password. Additionally, if you don't use sFTP, your password is sent in clear text across the Internet and can be intercepted.
Using a strong password (more than eight characters, mixed with numbers and symbols, without any common words) and connecting through secure channels can help prevent this.
Clean out any unfamiliar files
Make sure to check your web root for any files you don't recognize. If your account has been compromised, attackers may leave a backdoor script as a method of re-compromising your site.
Check for any files with odd modification times - times that you wouldn't have uploaded files to your web site, for instance.
Consider changing hosting providers
If you're already following good security precautions, then you might not be at fault. If FreeHostia is running server software that contains a vulnerability, or they don't follow security practices themselves, there is nothing you can do to secure your web site. Make sure to host your web site with a reputable host.
You're using WordPress and haven't updated, your source says 2.8.2.
At the bottom of your page is a script. eval(unescape('%64 ...
Check your theme files and the database, check the WordPress files or maybe try a clean install and restore the database.
Searching 'wordpress eval 64' has lots of results but pretty much you have to clean your files of that. It could just be the footer of your theme though.
Here's a link, http://wordpress.org/support/topic/evalbase64_decode-hacked, to the WordPress forums with links and help.
You apparently have a security vulnerability in your code.
You need to fix the vulnerability and remove all traces of the attack from your database and/or files.