Solved

Our site is infected with Exploit Blackhole - What should we do?

Posted on 2011-03-04
9
732 Views
Last Modified: 2012-05-11
See screenshot. This is coming from OUR website which is 100% legitimate and wordpress-based. What would be the first step to fixing this?

Screenshot of Exploit Blackhole
0
Comment
Question by:freshjuice
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
9 Comments
 
LVL 70

Accepted Solution

by:
Jason C. Levine earned 300 total points
ID: 35037912
Hi fresh juice,

Get your hosting provider on the phone immediately.  They should have the tools and expertise to deal with this.  Unless you know server security backwards and forwards, you are out of your depth.

Generally this happens because the server has been compromised and not because of WordPress, assuming you are running a relatively recent version.
0
 
LVL 16

Assisted Solution

by:sjklein42
sjklein42 earned 100 total points
ID: 35037932
Your site IS infected!

It looks like the infection is at the Web Server level not in your own scripts.

Who is your ISP?  Where is your site hosted?  Do you host it yourself?  The server is infected.

Are there other sites on the same server?  Can you check if they are infected, too?
0
 
LVL 78

Expert Comment

by:arnold
ID: 35038005
The issue is with one of your advertisers who has some of their stuff on IP 195.80.151.171.
If you can determine which advertiser of yours has this IP, you should notify them and until they fix their site suspend them from the ad rotation.
0
When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

 
LVL 78

Expert Comment

by:arnold
ID: 35038026
One other thing, currently your site is down with a PHP error.
The notice can be seen in a cached copy of the site.
0
 

Author Comment

by:freshjuice
ID: 35038041
1and1

All wordpress sites appear to be broken.

I'm on hold with 1and1 abuse support right now. :-(
0
 

Author Comment

by:freshjuice
ID: 35038052
@arnold - we have no advertisers. Everything we promote is self-contained. We do have an ad-rotation plugin that we run, however...
0
 

Author Comment

by:freshjuice
ID: 35038183
Okay, so 1and1 told us that one of our web developers had a virus on the machine that allowed someone from the Czech republic to steal our webmasters pass and login through the FTP front door to upload Perl scripts.
0
 
LVL 78

Assisted Solution

by:arnold
arnold earned 100 total points
ID: 35038272
The ad-rotation is it one of your own or do you generate references to other people?
Currently, your site has a PHP error.
index.php line 1
referencing wp-includes/pluggable.php line 890

if you have access to the server, while it is not necessarily dis-positive, you can search your files for modification after a known last modify date.

I.e. you have not made changes to the site since December 2010. But now you have files within the web root that were modified 10 days ago.
The other issue as others and I pointed out to have the server scanned 1and1 should be contacted to see whether the issue is within one of the systems that provides services for your domain.
0
 

Author Comment

by:freshjuice
ID: 35038390
Hi Arnold. Don't know if you missed my reply, it was a hacked password used for a front-door attack to our FTP.

I'll divvy some points for everyone's help.
0

Featured Post

PeopleSoft Has Never Been Easier

PeopleSoft Adoption Made Smooth & Simple!

On-The-Job Training Is made Intuitive & Easy With WalkMe's On-Screen Guidance Tool.  Claim Your Free WalkMe Account Now

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
BG appearing and then disappaear after a second 8 62
Set css in function 11 56
Error Handler 8 43
CSS Selector Chain NOT working for this situation? 3 16
This article discusses how to create an extensible mechanism for linked drop downs.
This article discusses how to implement server side field validation and display customized error messages to the client.
This video teaches viewers how to create their own website using cPanel and Wordpress. Tutorial walks users through how to set up their own domain name from tools like Domain Registrar, Hosting Account, and Wordpress. More specifically, the order in…
The purpose of this video is to demonstrate how to update a WordPress Site’s version. WordPress releases new versions of its software frequently and it is important to update frequently in order to keep your site secure, and to get new WordPress…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question