Help please, has my site been hacked

[bicyclerubber]

http://www.bicyclerubber.com/acatalog/

what should I do now?

[jont]

Oh dear

Firstly change all your passwords to the site to something much more secure and robust and totally away from what you have at the moment.

Your site is still there just the index page has gone - if you are cannot download any orders on the site via Actinic then FTP to the site straight away and download any .ord files and save for later.

I would then contact your host and ask them to wipe the folders clean for you - you could FTP and do this yourself but they may have installed something very obscure you may not be able to see.

Upload the site with your new passwords.

See what other replies you get before doing anything as others may have had personal experience and other ideas

[bicyclerubber]

cheers jont, I am on with that right now...

[wjcampbe]

Open Notepad
Click Save As, Choose type All Files, name the file index.html

Upload the new empty file to your /acatalog/ folder using FTP.

That will be how the guy got into your site to start with, s/he then found enough information in the folders on the site to access it and post a page.

Once you have an empty index.html in place to block new access, you need to go to your Host Control panel and change your FTP Password, then make the same password change in your FTP software and in the Actinic Network settings.

[bicyclerubber]

I have tried to wipe the lot but am left with two folders bbclone and a subfolder var

any ideas on what they are and how / if they need to be gone too...

[jont]

Not sure what they are for - but they appear to be empty when http'ing to the site

[bicyclerubber]

trying to upload the replacement files

error when sending merge request....

any ideas?

[jont]

You may be best using the Help | Trouble Shooting | Website Purge and Refresh option if you are not already doing that

[bicyclerubber]

cheers, I will give that a go now

[Phil_s]

bbclone is a page hit counter script

[bicyclerubber]

Still with trouble

Actinic received an request forbidden error from the web server. The server is not properly configured to allow Actinic to run CGI scripts from the cgi-bin. Run Web | Configure Web Site Details... to review your web site configuration.

When I do that it says

An error occured while attempting to change the permissions of a file or directory. There was a failure connecting to the ftp server in an attempt to execute a FTP chmod command

any ideas?

[wjcampbe]

FTP to your site outside Actinic and check to see if you have an existing cgi-bin folder. If you do not, create one and change the properties on it to 777 before going back to Actinic and trying again from there.

Actinic will reset the properties to 755 once it has gained access - but you should connect by FTP outside Actinic again after you upload, just to check.

[bicyclerubber]

tried that, even tried setting everything to 777 - same result

struggling with this now

[wjcampbe]

Have you set a new FTP password on the site, and entered that new password into the Network Setup page in Actinic?

[Sally Dickson]

777 not the answer

Changing everything to 777 does not work.

I know this because when I was setting yp my second shop I got in a muddle and did that and made no progress.

the acatalog/ has to be 777
the cgi-bin/ has to be 755.

That is the Bible, both acatalog/ and cgi-bin/ have to be on the same level.

Reset those, and you know you have so much right...

can't help with the rest though .