Hacked -- Help

[blogmediagroup3]

This is both a warning and a request for assistance.

The warning: following my posting of URLs here, I checked my sites and they were both hacked by some jerk. Here is the message:

By BeyazKurt | Albanian C0der

Bypassed ßaby

This appears instead of my Thesis theme. I did a Google search on the message and it is appearing on hundreds of sites.

The call for assistance: How do I correct this? I can't even get word out about my site being hacked. Any help ASAP will be greatly appreciated.

[kingdomgeek]

The first thing you're going to want to do is contact your host -- something somewhere on your site is insecure and they're going to want to know about it. Likewise, they may be able to assist you in finding the vulnerable point.

Second, hope that you or your host has a recent backup. I've had my site(s) hacked a handful of times over the years, and not having backups is a pain through and through.

I'd wait until you determine the vulnerable point before re-introducing your site; if something on it was vulnerable, the hack may occur again. In the mean time, you may consider placing a static file named index.html in the root of your server explaining what has happened and that your site will be back soon.

The folks on the WordPress support board may be able to help you further, if you suspect that this has happened because WordPress or a plugin is insecure.

Google has some explanation on how to handle a hacked site on their Webmaster Central blog.

[gdpmumin]

I can't echo kingdomgeek's suggestions enough. A site I used to maintain was hacked a couple of times due to a browser exploit a few months ago. None of the research I did really described what a browser exploit was. It was my first experience with this sort of thing. I called my host (Network Solutions) and they walked me through a .htaccess fix. So far, it hasn't happened again.

[rumblepup]

It looks like a sql injection hack to me, which I've had some experience enduring Latest info on SQL injection attack. | rumblepup. I don't know if there is some vulnerability not seem in wordpress before, or if the databases for these sites where vulnerable.

Looks like a lot of Joomla sites where affected as well.