I'm getting weird results from Yahoo Site Explorer when I search my site (lorcanmacd.com). It's showing a lot of files that I've no idea how they got there. When I click to explore these files it says '404 not found'. Has my site been hacked? What's going on?
Looks like it. You need to dig around your site and look for files you didn't no upload...delete them. This is another way hackers do their thing.
Thanks for the quick reply Vaska. How do I know which files to delete and which ones I shouldn't? There seems to be some suspicious files in the logs folder in Cyberduck but it won't let me delete them. Should I be looking there or loging in to my site itself?
Do you have any tech savvy friends who could help you with this? I don't recommend deleting if you don't know what you are doing. But, if there are dangerous/hackery files on there you need to remove them.
Unfortunately I don't have anyone around to help me. I don't mind reinstalling the whole site as it needed an update. At the moment it's telling me 'Permission denied' when I try to delete the logs.
Permission denied is bad - have you asked your host about this? I'm willing to bet a ton of people on the same server were all hacked at the same time.
I did get this when following a link from my hosting service:
"WebShell Removal from HSphere Platform
We take the security of our customers' hosting services very seriously and as such we would like to inform you that our engineers have discovered a potential security flaw in the WebShell file manager. In order to preempt any risk of a security breach that may affect our customers' websites the WebShell feature will be turned off as of Midday on Tuesday 9th February 2010 ."
I have a report in with them about the problem. I think the 'Permission denied' notice from Cyberduck might have something to do with me updating some info in my online control panel. I'll wait until I get a reply from my hosting service before I do anything else.
You need to be logged in to post.