Posted by sadig.gulaghayev on May 14, 2013 at 5:40pm
Hi All,
Recently my drupal based web-site was hacked. The following is more information:
Title: hacked by you
Date/Time: This website is still defaced as of 05/06/2013 10:20 AM (EST)
Defacer: Hmei7, ulow, s13doeL
Domain: hxxp://comm-res.oswego.edu/x.php
IP Address: 129.3.1.35
System: Win 2008
Web Server: IIS/7.0
These is the first time and I don't know where to start the process and how to identify/detect what happened and how to prevent it from future issues. I highly appreciate any ideas or thoughts.
Thanks,
Sadig
Comments
Start
Start here:
https://drupal.org/node/213320
If your website is on shared hosting, chances are that this has nothing to do with your Drupal site, rather your host has been hacked.
--
Dave Hansen-Lange
Director of Technical Strategy, Advomatic.com
Pronouns: he/him/his
Dave, Thank you for your
Dave,
Thank you for your respond. My website is on VMware/VMserver and there is no other website is hosted in that. But it is good idea, I will check IIS logs.
Thanks,
Sadig
When I go to the
When I go to the comm-res.oswego.edu/x.php, I see the following message:
hacked by Hmei7 & ulow & s13doeL
indonesian people
civic module owned !!!