Security - Links edited by Hack forward to finditnow.osa.pl

Hi Community

I installed the very last version of boonex dolphin on my domain and after two months of productivity I've got someone hacking my site. There are several pages with edited links (menu selection, and so on) pointing now to {Edited by Zarcon: LINK REMOVED} instead of "home" or whatever internal it pointed to.

I already asked my hoster and he told me, that they are still using PHP 5.2 and that the best way to get rid of this problem would probably be to reinstall Dolphin completely.

Two questions now:

1. Is there no other way? I mean it took quite a little bit of work to configure the whole site for my needs
2. And if yes: and then - after another two months there's again a hacker changing my links to this polnish site?

Thank you very much for your help!

Amulex

Yes you site is infected! Close your site, change Cpanel, FTP access. And make fresh install of dolphin or hire some body here for clean your site

more than just reinstalling, you need to find out how your site was compromised. this most specifically has nothing to do with dolphin in general, as much as it has to with where you are hosted possibly, moreover, who you have given access to your account.

for the most part, you can dig through whatever content you have uploaded, images | videos | music, you can most likely grab whatever edits you have done on the template, your database should be relatively safe. so you could recover your site, just takes work.

Do you have a dedicated server? If so, ask the hosting company to forward to your email all root warnings regarding WHM access.

Also make sure you change all you passwords (cpanel, FTP...) every 15 days at least and check your PC fr malaware.

It is not easy, as DosDawg said, but it is possible to clean your site.

Best of luck

Hi Community

Thank you very much for your answers.

Just a question: what about keeping the database (export into an sql-script) and just reinstalling the Dolphin into the same folder after deleting everything in there and then, once everything installed, reimport the SQL-Script?

Or what if I asked my hoster to restore the version of my file-directory from a few weeks ago?

Should this work?

Please note: all other sites on my are not having the same troubles - so I guess, there must be something wrong with (my) Dolphin Installation. Does it use Wordpress? I changed anyway my cpanel password.

Thanks for another hand on this topic.

Amulex

Hello yes you can try merge your old database's data with new

There's probably a 90% chance that you hacked your own site.  You probably picked up a worm from a malicious website, possibly by clicking on a shortened url... a popular way to lead people to malicious sites because people are used to it, and it looks less suspicious.  These particular worms sometimes launch a fake virus scanner, and once you click on anything, you're infected.  The worm could have infected file transfer programs on your computer, then it could add some redirect code to files as they are transferred to your site.  It could be javascript, or base 64 encoded.  Suspect files that you recently uploaded.

Before you do anything else, you need to make sure that your own computer is clean.

It would be wise for someone at Boonex to edit the original post in this thread to remove the link to the malicious website.

Link removed

Hi all

Thank you very much for supporting me with this topic. I'll try now to delete all files, reinstall Dolphin 7.0.6 and reimport or reuse the same database as before.

Meanwhile I already checked my computer for Viruses - it seemed clean with an updated Antivirus Scanner and I also changed all possible passwords (cpanel, etc.).

It's really great the support I got here and your patience with a naive web admin... It's such a pitty that there are people passing their time with destroying others people's work.

I'll see how it worked finally.

Thank you anyway for your help and support. Sorry for putting the bad link into the topic of the post.

Enjoy your day

Amulex

Hi Community

It's me again. A last question. I was able to recover in all my audio files again. But what about pictures and files? How can I reimport my old pictures and files?

I was not able to find the path. I thought it's modules/boonex/photos/data/files. But if I place my pictures there, I only get it when clicking onto "Show original". In the show picture part there is nothing in...

Thank you!

Amulex