Monday, August 24, 2015
Today in our #NoHacked campaign, we'll be discussing how to fix the injected gibberish URL hack we wrote about last week. Even if your site is not infected with this specific type of hack, many of these steps can be helpful for fixing other types of hacks. Follow along with discussions on Twitter and Google+ using the #NoHacked tag. (Part 1, Part 2, Part 3, Part 4)
Temporarily Take your Site Offline
Taking your site offline temporarily will prevent your site's visitors from going to hacked pages and give you time to properly fix your site. If you keep your site online, you run the risk of getting compromised again as you clean up your site.
Treating your Site
The next few steps require you to be comfortable making technical changes to your site. If you aren't familiar or comfortable enough with your site to make these changes, it might be best to consult with or hire someone who is. However, reading through these steps will still be helpful.
Before you start fixing your site, we advise that you back up your site. (This backed up version will still contain hacked content and should only be used if you accidentally remove a critical file.) If you're unsure how to back up your site, ask your hosting provider for assistance or consult your content management system (CMS) documentation. As you work through the steps, any time you remove a file, make sure to keep a copy of the file as well.
Checking your .htaccess file
In order to manipulate your site, this type of hack creates or alters the contents of your
.htaccess file.
If you're not sure where to find your .htaccess file, consult your server or CMS
documentation.
Check the contents of your .htaccess file for any suspicious content. If you're not
sure how to interpret the contents of the .htaccess file, you can read about it on
the Apache.org
documentation, ask in a help forum, or you can consult an expert. Here is an example of a
.htaccess modified by this hack:
<IfModule mod_rewrite.c> RewriteEngine On #Visitors that visit your site from Google will be redirected RewriteCond %{HTTP_REFERER} google\.com #Visitors are redirected to a malicious PHP file called happypuppy.php RewriteRule (.*pf.*) /happypuppy.php?q=$1 [L] </IfModule>
Identifying other malicious files
The most common types of files that are modified or injected by this hack are JavaScript and PHP
files. Hackers typically take two approaches: The first is to insert new PHP or JavaScript files
on your server. The inserted files can sometimes be named something very similar to a legitimate
file on your site like wp-cache.php versus the legitimate file
wp_cache.php. The second approach is to alter legitimate files on your server and
insert malicious content into these files. For example, if you have a template or plugin
JavaScript file on your site, hackers might add malicious JavaScript to the file.
For example, on www.example.com a malicious
file named happypuppy.php, identified earlier in the .htaccess file, was
injected into a folder on the site. However, the hackers also corrupted a legiti