LovePotion

[Dami]

I'm new to these hacker attacks and haven't a clue how they occur or what I can do to prevent this from happening again. Can anyone fill me in or direct me to a site that will explain what's going on and what I need to do to protect my site?

Just thought I'd look at my site and found the Love Potion crap on my index page (and all pages with the word index in it). Fortunately, McAfee caught the trojan on my PC. Pages affected were all dated 1/4/2008.

[Dami]

Thanks for all the help!

[Vin DSL]

LoL! Everybody's asleep...

The first thing you need to do is investigate your logs (this is a tedious task) and find out how the attackers got into your web site, and what they did. Then, you need to protect against it.

Once you get everything under control, you need to start thinking like a hacker yourself...

Run around the hacker hangouts, find out what the latest methods are, and start attacking your own site. If you find a vuln (before the hackers do) fix the problem and attack your site some more.

It's a cat n' mouse game that never stops, sooooo...

If you find something specific in your logs that you can't figure out, let 'us' know. There's a lot of talent in these forums - negative, positive, and neutral!

[Frank Broughton]

If you are on a shared or semi dedicated account - as I assume you are seeing you posted in that forum, your system should be hardened and you only have to look at what scripts YOU have installed.

What apps do you have installed? (word press, phpbbs etc?)
Are they all up to date?

[Dami]

Thanks, Frank and Vin, I appreciate the responses.

As for apps, I don't have any installed--at least nothing that wasn't already installed when I signed on. I was using a formmail script (it wasn't working) and some javascript, a few php pages and a mysql db but that's it. It's a very low-tech site.

I have the Gigadeal - Shared Hosting Plan, so I assume I'm in the right forum.

You suggested I go through the logs--what do I look for?

Think like a hacker? Sorry, I don't have that mentality, not to mention the time or inclination to have to do it. Isn't that part of the web host's responsibility? (Sorry, I don't understand what happened or how it happened. I have a feeling I need to go to a host that's a little more hands on as I don't have the expertise to deal with this stuff.)

Again, thank you very much for responding. I don't mean to shoot the messengers.

[JPC-Veena]

Dami,

All you need to do is open a support ticket and we can provide you with the guidelines on how to secure your scripts/account.

[Frank Broughton]

I have a feeling I need to go to a host that's a little more hands on as I don't have the expertise to deal with this stuff.)

Open a ticket as Veena suggested. If you site is static and still stock and on a shared server JaguarPC should be the one responsible.