By jessmagz on

Hi everyone!

I have a drupal site hosted by drupalvaluehosting. The servers were hacked recently and my site was affected. Please take a peek: http://sanfranciscomirror.net

According to the tech support, I just have to restore the original Drupal's index.php page which I did lately. The hacker replaced ALL index.html and index.php files in the web root with his index files. After restoring all my index files to Drupal's original, the hacker's page still loads!

I cleared the cache at admin/setting (Performance) hoping the pages were just cached that's why it still loads though the hacker's index where deleted. I also deleted my browser's cached data and then revisited my site. The hacker's page still loads.

I entered the cPanel then went through phpMyAdmin and TRUNCATED all "cache" tables. Then i ran the cron. After that at the Status Report page it says something like: "You should update database immediately".

When i attempted to update the databate (site/update.php) there the hacker's page appeared again.

What shall I do with this? The site is in offline mode because i'm just setting the themes and modules and everything. I just made a little content inputs.

Please help....

Jess
Philippines

⋅ Categories: Drupal 6.x

Comments

gforce301’s picture

gforce301 commented

Remove the file index.html from your root folder.

Edit:
Actually it looks like he got your index.php file again also. change your passwords and re-upload your index.php file too.

jessmagz’s picture

jessmagz commented

i tried... it just didn't work...

xmacinfo’s picture

xmacinfo
he/him
Primary language French
Location Canada
commented

It is important that the .htaccess file is also replaced by a fresh one.

/*_*/
http://www.xmacinfo.com

jessmagz’s picture

jessmagz commented

it didn't work still....

aitala’s picture

aitala commented

Can you remove all the files in the web root, including .htaccess? Assuming you have a safe backup somewhere... Then try the URL for the web root and see what happens.

I wonder if the httpd.conf file for you site has been hacked. Its odd how no matter what URL you use (like http://sanfranciscomirror.net/junk ) , you get the hack splash page.

E
__________

Eric Aitala

__________
Eric Aitala - ema13@psu.edu
Penn State

224b8605113373e086cb27708ff301ba18ce394db1996e7e22928e4555e0d20b1b6cecc7f67c9bd9e536cb915779c485

mm167’s picture

mm167 commented

1. talk to your web host support. it is his/her duty to resolve this issue for u.

2. about index.html and index.php
drupal use index.php, instead of index.html.
this is configured in the web server. say, inside the httpd.conf file if u are using apache httpd as your web server. Any way, as u are using a host service, the web server belongs to the host company, not u. so, talk with the tech support of the host company.

most likely, the hacker has modified the configure file of the web server.
in this case, even u reinstall the Drupal, u wont solve the problem.

..sorry to hear u story

good luck.

jessmagz’s picture

jessmagz commented

thanks for the advice guys! I was really about to reinstall Drupal and worried because I don't have any back up. Anyway, i just have a little content there. I even placed it in offline mode so that I will just setup the site - the themes, the modules to use, and then finally place contents.

Anyhow, my problem is, DrupalValueHosting can only be contacted thru email and it will take a long time before you get a reply.

I just what to ask one more thing. I am new to website hosting. In my case, does this mean that the hacker was able to alter the "webhost" server and thus affected my sites in my hosting account? or does this hacker can actually access my webhost admin (login) account and can then alter everything therein?

Thank you... will try my best to contact DVH. Can you please suggest a "more secure" webhosting company that supports Drupal? I might transfer hosting there...

aitala’s picture

aitala commented

See http://drupal.org/hosting

I would say any of the affiliates ( the first 19 ) should be good. GoDaddy can be cheap but those plans are slow.

Eric

__________

Eric Aitala - f1m@f1m.com
The Formula 1 Modeling Website
www.f1m.com

__________
Eric Aitala - ema13@psu.edu
Penn State

224b8605113373e086cb27708ff301ba18ce394db1996e7e22928e4555e0d20b1b6cecc7f67c9bd9e536cb915779c485

jessmagz’s picture

jessmagz commented

thanks everyone!

It seems that the webhost DVH had fixed the problem... I just hope so...

tomerson’s picture

tomerson commented

We used dotdefender to protect our drupal site.