News:

Wondering if this will always be free?  See why free is better.

Main Menu

has my site been hacked? please help

Started by timidapsin, March 20, 2017, 09:20:35 PM

Previous topic - Next topic

timidapsin

I just found out that my my site redirects to another site for example http://mysite.com/~unknownsite.com/ leads me to the unknown site url.
I cant seem to find /~unknownsite.com/ in my root folder in cpanel which means i can't remove it.
Please help

Sir Osis of Liver

If you can pm ftp access (server/username/password) will have a look.
Ashes and diamonds, foe and friend,
 we were all equal in the end.

                                     - R. Waters

Illori

or if you can provide us with a valid URL so we can look into the issue we may be able to offer more advise on how to resolve the issue.


Illori

i am not getting any redirect, but i would recommend you put index.php back in your URL as removing it is known to cause issues.

timidapsin

Quote from: Illori on March 21, 2017, 07:28:42 AM
i am not getting any redirect, but i would recommend you put index.php back in your URL as removing it is known to cause issues.
that wouldn't fix it...
http://afriwap.com/~infoway/ leads to another website that i have no idea of.
I don't know how /~infoway was created that...

Illori

Ask your host. I bet that is another website they hosting.

Kindred

yup...   I get a blocked warning indicating a redirect to a known dangerous site...

It looks like you may have been hacked at some point.

So...   What version of SMF are you runinng?
What mods?
Are you running any OTHER software on the website?
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

timidapsin

The site is running on SMF 2.0.13
And this are the mods installed








Kindred

In the future, when asked for a list of mods, please use a TEXT listing instead of an image.

What about the final question?
Quote from: Kindred on March 21, 2017, 11:37:25 AM
Are you running any OTHER software on the website?
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

timidapsin

Quote from: Kindred on March 21, 2017, 01:59:58 PM
In the future, when asked for a list of mods, please use a TEXT listing instead of an image.

What about the final question?
Quote from: Kindred on March 21, 2017, 11:37:25 AM
Are you running any OTHER software on the website?
sorry about that...
I am not using any software on the site

Kindred

Hmmm.... so, SMF is the only thing running on your site?

Did you give Sir Osis of Liver the FTP access that he requested?
If so, he can hopefully check your files and logs.

I would recommend also checking with your host and asking them to do a filecheck of your site.


SOMETHING has been compromised...  we know of no security issues in 2.0.13, so either the used a different route (another software, another site on a poorly configured server, etc) or there is something that we need to track down with the help of you and your host.
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

timidapsin

Okay i contacted my host and told them about the issue, i also demanded explanation on how ~infoway gained access to my site url ( http://afriwap.com/~infoway/imgs/mei.php)
As explained by them (My host), infoway is the username that belongs to a site in the same shared server with my site (afriwap.com)

Colin

Is this your personal hosting account or are you sharing this (shared) hosting account with someone else?
"If everybody is thinking alike, then somebody is not thinking." - Gen. George S. Patton Jr.

Colin

Kindred

If infoway is a completely separate and unrelated hosting account on the same server, then you need to leave that host like your pants are in fire...   get out and get a reputable host who knows how to configure their server
Слaва
Украинi

Please do not PM, IM or Email me with support questions.  You will get better and faster responses in the support boards.  Thank you.

"Loki is not evil, although he is certainly not a force for good. Loki is... complicated."

timidapsin

Quote from: Colin on March 21, 2017, 07:47:16 PM
Is this your personal hosting account or are you sharing this (shared) hosting account with someone else?
Shared hosting

Advertisement: