Web Site has been hacked

Junk files added after </html> on Home page

[Senmar50]

Hi,

The home page of my web site has been hacked. At the end of the page, after the </html>, all kinds of links are listed. The home page has at least 500-600 of the junk links. When you open my web page, windows ask if you would accept an "Add-On" script. I just said no, because I didn't add anything. I downloaded the home page to my computer, and removed the bad files. What can I do to make sure, it will not happen again.
Thanks,
Senmar

[edited by: phranque at 9:57 pm (utc) on Mar. 9, 2009]
[edit reason] No urls, please. See TOS [webmasterworld.com] [/edit]

[Demaestro]

Go through your raw access files and search for PUT or webdav

Chances are however they changed the file they used a PUT or some webdav vulnerability.

Once you find how they did it you will be able to answer how to stop it from happening again.

[dreamcatcher]

Is it a shared server attack from another site? Moving to a dedicated server or another host is probably your best bet.

dc

[Senmar50]

I just found in my root directory a "php" file listing all the links that appeared at the end of my web pages:

<?
phpinfo()
?>
<u style=display:none</a>LOTS OF LINKS</u>..

I also found out that all the "html and php" files in the root directory were hacked. The bottom of all these pages listed the links that were in the "php" file.

I cleared the links from all the hacked pages; and deleted the php file. Everything seems to be alright for now. How do I secure my root directory? This is the first time I've been hacked, after six years.

Thanks for your help...
Senmar

[phranque]

you might find useful information in the following WebmasterWorld threads.

Hacker gets access to server. How?:
[webmasterworld.com...]
How Hacked Servers Can Hurt Your Traffic:
[webmasterworld.com...]
Securing A Linux Web Server:
[webmasterworld.com...]