help please My site is hacked by gabby the crows crew

leen12 · 08-15-2013, 12:53 AM

hi my website just got hacked like 2 or 3 hours ago and my homepage just shows my logo and footer and above my logo it says hacked by gabby -=[The Crows Crew]=-

can anyone help me asap please?

bluedog.tar.gz · 08-15-2013, 01:00 AM

Let me guess, you have a wordpress site and your admin cp is in /wp-admin/ ?

leen12 · 08-15-2013, 01:03 AM

no its a phpvibe cms website.. but the cp is in defualt place

bluedog.tar.gz · 08-15-2013, 01:04 AM

(08-15-2013, 01:03 AM)leen12 Wrote: no its a phpvibe cms website.. but the cp is in defualt place

Hmm, I don't have experience with phpvibe.
Were you using a 'secure' password first of all?

https://howsecureismypassword.net/

leen12 · 08-15-2013, 01:05 AM

no not really.. its one i used years ago but its kinda shit would be easy with a brute forcer..

holy shit lol i just checked that website basicly every password i use is upto 10 minutes =s

bluedog.tar.gz · 08-15-2013, 01:06 AM

(08-15-2013, 01:05 AM)leen12 Wrote: no not really.. its one i used years ago but its kinda shit would be easy with a brute forcer..

There are alot of ways to get hacked. Tho some of us forget how easy it is to get in. If you were using passwords such as '123456' then I can assure you that its not very hard to get in.

Do you have any anti-bruteforce protection on the admincp?
Were you using any good CDN to prevent bad visitors? Or do you have a secure .htaccess ?

leen12 · 08-15-2013, 01:10 AM

im not really experienced in any of that to be honest.. as far as i know admin cp does not have bruteforce protection not sure though..

password might as well be 123456 but no lol its close

whats a cdn? i have them options on my server i think but dont know what it is or anything

htacess is chmod 664 is that what you mean?

bluedog.tar.gz · 08-15-2013, 01:12 AM

(08-15-2013, 01:10 AM)leen12 Wrote: im not really experienced in any of that to be honest.. as far as i know admin cp does not have bruteforce protection not sure though..

password might as well be 123456 but no lol its close

whats a cdn? i have them options on my server i think but dont know what it is or anything

htacess is chmod 664 is that what you mean?

Try this to see if you have any infected files;

http://sitecheck.sucuri.net/scanner/

leen12 · 08-15-2013, 01:14 AM

hmm no it seems clean i think

http://sitecheck.sucuri.net/results/viralwire.co.uk

Sucuri
web site: viralwire.co.uk
status: Verified Clean
web trust: Not Blacklisted
*This site was just scanned a few minutes ago.

Security report (No threats found):
check Blacklisted: No
check Malware: No
check Malicious javascript: No
check Malicious iFrames: No
check Drive-By Downloads: No
check Anomaly detection: No
check IE-only attacks: No
check Suspicious redirections: No
check Spam: No

bluedog.tar.gz · 08-15-2013, 01:17 AM

(08-15-2013, 01:14 AM)leen12 Wrote: hmm no it seems clean i think

http://sitecheck.sucuri.net/results/viralwire.co.uk

Sucuri
web site: viralwire.co.uk
status: Verified Clean
web trust: Not Blacklisted
*This site was just scanned a few minutes ago.

Security report (No threats found):
check Blacklisted: No
check Malware: No
check Malicious javascript: No
check Malicious iFrames: No
check Drive-By Downloads: No
check Anomaly detection: No
check IE-only attacks: No
check Suspicious redirections: No
check Spam: No

Do you have any backups? If so, do a restore and change the admincp password.