wwp@yahoogroups.com:
Re: I think my website has been hacked. HELP!
Serge Maandag (yahoo) 2006-Nov-09 21:04:00
> I was just trying to access my website, but everytime i type my addy i
> get this message : Bad Request (Invalid Hostname)
>
> I tried to access through my FTP program but I keep getting password
> error.
> so whats up?
Could be all kinds of things. A major misconfiguration, a wrong dns entry
for the host, a full disk on the server, a half crashed operating system
or you are hacked.
> am I hacked?
It's not so easy to see that at once.
> I am using statcounter on my website and it seems there was someone
> who entered my website today and stayed for four minutes.
> and there are traces like "/C:/sites/3sixty/gallery.htm"
> which is weired cuz I usually see this when I update my website.
It looks like an attempt to see things someone shouldn't see, but it does
not look like hacking. There is no sign of a remote script being included,
no buffer overflow or anything nasty like that.
> PLEASE HELP ME AND EXPLAIN WHAT IS GOING ON.
Are you hosting it on your own machine? It's a win2003 machine according
to www.netcraft.com.
You could start here: http://www.cert.org/tech_tips/WIDC.html
> And I have the IP, but it says ministry of education!
that may be spoofed. If your site is on the server of a hosting provider,
ask them what the heck is going on..
Serge.