1

We are puzzled about a very weird incident. There is a website our company runs: Now, every couple months, we get reports that clicking the menu opens XXX-popups. This is really weird, because …

  1. We cannot replicate that
  2. It only happens occasionally
  3. It happens repeatedly since over two years now

This is really weird, and really undesirable. Does anyone here have any idea as to what we could at least look for?

4
  • I edited you question for safety reasons given the question. The edit also prevents your question from being closed for being about one site.
    – closetnoc
    Dec 18, 2015 at 16:35
  • We get questions like this often. You site has likely been hacked and is compromised. Update your software immediately, audit user names and force a password change. Run an anti-virus software including rootkit on your hard-drive. Use web.nvd.nist.gov/view/vuln/search?execution=e2s1 to research software vulnerabilities. Check your plug-ins and themes too. Check your files and database for something amiss.
    – closetnoc
    Dec 18, 2015 at 16:38
  • Thanks for the advice! We have found the issue, the server had indeed been hacked.
    – Christian
    Dec 19, 2015 at 17:49
  • I am glad you found the problem! It happens all the time so you are not alone. It is a bummer, but too many CMS and other software contain vulnerabilities. Even if it does not, themes and plug-ins can more easily. So what do you do?? Check for vulnerabilities using the link I provided fairly often. They also have an e-mail alert that can help. When I was a core network engineer for a global telecom and a web host, I used to receive as many alerts in e-mail as I could to make sure the 1000+ servers I maintained were as secure as they could be. One hack and you can be toast.
    – closetnoc
    Dec 19, 2015 at 17:58

1 Answer 1

1

This happens quite often and usually indicates that the site has been hacked and is compromised. The best course of action is to update your software immediately, audit all username's and force a password reset for all accounts. You should also run anti-virus software on the server HDD and check the files and database to see if something appears wrong with them and rectify any detected issues. (Answer from comment by @closetnoc)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.