my site was hacked

[::ALEX::]

please tell me how can i stop him

[tut2tut]

clean your PC first.(re install OS if you don't know)
then change all user/pass of your server.
also check your server files.

do not open/run suspicious exe files.

[hulkman]

Use Virtual keyboard , And try changing pass. If they still hack . Format your pc, Clean your files in server and restore backups.

[immu]

Format ur PC or Install Kaspersky Internet Security 2012 and scan you PC
then setup your websites again

[Lock Down]

Follow all the suggestions you have been given by all the members!!!!!!!!!!!!!!!

[antpeks]

well, it seems your website is defaced, as i read in the first post, not hacked. there is a serious difference between a defacement and hacked server.

Defacement of a server means that they gained access thru a scripting error, a mysql injection or a backdoor in a (nulled) script. But it is not restricted to scripting only, it could mean that your server is running not up to date software (apache, php, exim, or whatever is installed and running)

How to proceed, make sure that on your end you have up to date software, install security patches everytime they are released, keep your server up to date (or ask your hoster) Tell your hoster that you have been defaced (ask maybe for access, error and other logs regarding your domain as you cannot reach it yourself)

Overlook your directories for malicious code, sometime they are able to upload just a bit of code and redo the defacement, and as i see in you first post the guy or girl who did this is posting it to let you know there is a security flw in you config or scripting, google his/her name maybe you might find a solution to your problem. Or even a contact email and ask him what he/she did and how to solve it.

there is mostly one solution to defacements: update update update over and over again.

[Whoo]

My suggestion is to find out how he got in, if you have SSH access this shouldn't be too hard. Have a look at the access logs, error logs, look for files that were modified the last x days (find /home/you -iname "*.*" -mtime -60 -print) => replace 60 by the amount of days.

If you need any help (only with SSH access) I'm available for hire to have a look

[Suhel]

First thing first reinstall you pc

[parvshell]

Did you accidentally gave out your server account and password?

Dear...we can See your Joining Date: Jun 2012.....Its NO more A Secret !!
So, Please Relax&Enjoy your Time.

For OP:ALEX: Yeah! Man Disinfecting whole system should be your 1st Step.....then going real Hard with Passes.....& Finally your Server&Files Check.

GOODLUCK Bro.......Hope you get well soon.

[::ALEX::]

Thanx Guys For Your Replies