: This is an example of a hacked server which was done by stealing FTP information. All your questions on how to remove it fully can be found here: http://blog.unmaskparasites.com/2011/05/05/thousands-of-hacked-sites-seriously-p

@Bryan171

This is an example of a hacked server which was done by stealing FTP information. All your questions on how to remove it fully can be found here: blog.unmaskparasites.com/2011/05/05/thousands-of-hacked-sites-seriously-poison-google-image-search-results/comment-page-1/
Most importantly:


If your site happens to be one of the
compromised sites that host malicious
doorway pages:


Thoroughly scan your computer for malware
Once your computer is clean, change all site passwords (even for sites
that don’t seem to be compromised
yet). Don’t save passwords in FTP
clients – most of them can’t protect
your passwords from malware. Consider
using password managers (like
KeePass) that encrypt all data with a
master password.
Use SFTP instead of FTP if possible.
Now remove the doorway .php script, .htaccess file with rewrite rules if
it was created, the .log/ directory
and all its content.
You should also scan your server for suspicious files that might
have been uploaded to your server
using the ?up100500 requests.

Vote Up Vote Down

Login to post a comment!