urgent - my website is hacked

[abutik17]

I just found out that my website is hacked, or rather hijacked by a cyber-criminal group....
I don't know what their intention is, but my website does not show my content anymore, it only shows one page telling me that the website was hacked, all the links on my website redirect to that one page....
however I can still access the cPanel, and there is one strange new file, that wasn't added by me, when i delete it
it keeps re-creating itself automatically...
please help me with this issue,

btw I will be upgrading the hosting to paid hosting soon, let's hope it's more secure, but for the mean time, can you please help me access my website again?..

Thanks for your help


---------- Post added at 01:14 PM ---------- Previous post was at 12:40 PM ----------

they removed all my files now
what should I do? do you keep backups of the websites? does Starka auto-backup the sites?

---------- Post added at 03:37 PM ---------- Previous post was at 01:14 PM ----------

please help, these people have root access to the server, and can damage any other website on the same server (Starka)
they have my MySQL database info, and can use it to target other websites,
the files on my hosting account are still there but I can't see them, because they changed my privileges and permissions, since they have root access.

[Dead-i]

I suggest you change your password immediately from within your control panel, ensure your public_html and directories inside it are set to Permissions 0755. Ensure there are no PHP scripts with vulnerabilities too.

btw I will be upgrading the hosting to paid hosting soon, let's hope it's more secure, but for the mean time, can you please help me access my website again?..

It is not our fault if you have chosen an insecure password or have vulnerabilities in your website.

what should I do? do you keep backups of the websites? does Starka auto-backup the sites?

No, it is your responsibility to take backups of your files.

please help, these people have root access to the server, and can damage any other website on the same server (Starka)

What makes you think that?

[abutik17]

thanks for the reply Dead -i , regarding the last quote, I can tell they have root access, because they have hidden all my files, my files are still there, but I can't see them, if I try to upload a new file it gets hidden, therefore, i can't change any permissions of files with public_html
I will change my password immediately

[descalzo]

What software are you running on your site?

Have you uploaded anything recently.

And I seriously doubt they have "root access" in that they have access to any account on Starka.

[Livewire]

I don't see any evidence of a hack or unauthorized root access to the server, but I do see a nulled vBulletin install which is back from october 5th, prior to this supposed hack, which is obviously a bad thing.

I also was unable to confirm that a hack has actually taken place; nothing looks out of place, and the files are indeed on the account. The last modified times also indicate that not much has changed recently, but if you had reuploaded backups the times would be different than I'm seeing.

In any case, the nulled vB counts as a major violation to the Warez section of the TOS.