Member Avatar for chand.

If any body search for heady00, she/he got such an entry that I write below.

hacked by OsmanliTIM hacked by OsmanliTIM. ...

That is my site I don't know what's wrong with it. Hacked means what ? I don't have any crucial or important things here instead of just a message that my site is available soon. But I'm very tensed from this annoying thing. Chrome suggest me to don't open this website because it has some malware inside it. Any ideas.

Thanks
chand

  • 3 Contributors
  • 11 Replies
  • 134 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Rik_

Dani AI

Generated

Summary and practical next steps based on the thread: the site appears defaced and a browser flagged it as malicious. @chand reported the issue, pointed toward host-side investigation, and ’s experience illustrates that visitors and the owner’s workstation can both be affected. The priority is containment, a careful cleanup, and preventing reinfection.

Containment and evidence

  • Take the site offline (simple maintenance page or pause hosting) so the attack cannot spread or re-trigger while you investigate.
  • Create full, forensically-sound backups of files and the database before you change anything; preserve server logs and timestamps for the hosting provider or an incident responder.

Cleanup checklist (apply in order)

  • Work from a clean machine (not the infected PC described in the thread) when changing passwords or accessing admin tools.
  • Locate differences vs a known-good backup: identify recently modified files and new/hidden uploads. Look for obfuscated code, unexpected PHP files in upload directories, or unusual file permissions.
  • Search for and remove web shells, hidden cron jobs, unfamiliar SSH keys/accounts, and modified configuration files. Scan server files with malware scanners available on the host.
  • If you cannot confidently remove every backdoor, rebuild the site from a verified clean backup or fresh install, then selectively restore content you have manually inspected.

Host, account and post-clean actions

  • Ask the host for raw access logs, and whether other accounts on the same server are affected. If the host confirms a server compromise, insist on a full environment rebuild.
  • Change all credentials (hosting, FTP/SFTP, database, CMS admin, registrars) from a known-clean device and rotate any keys.
  • After cleanup, request blacklist removal or a review from browser vendors/search engines and enable ongoing protections: WAF/mod_security, strict file permissions, automatic updates, strong passwords, SFTP-only access, and regular backups.

Notes and cautions

  • Do not assume local cleanup fixes server issues; equally, an attacker who stole credentials from an infected PC can reintroduce malware after a server cleanup. Coordinate both sides.

Recommended Answers

All 11 Replies

Member Avatar for Rik_

Do you have FTP access to it?


[Edit] I had a look and it looks fake to me.

Member Avatar for chand.

Do you have FTP access to it?


[Edit] I had a look and it looks fake to me.

Yes I have access through ftp and also from cpanel, but if you go here <snip> then might be you got a warning, probably if u go through the chrome.

Member Avatar for Rik_

I use FireFox with WOT and got no real looking warnings at all.

Check your Cpanel to look for an intrusion. There should be access logs on there somewhere.
Also, get in touch with your website provider and let them know what has happened.

Member Avatar for chand.

Allright RIK, thanks so much once again. The fastest guy on any forum I ever seen.

Thanks

Member Avatar for Rik_

Jholland1964 reported problems after visiting your site.
Might be an idea to delete it from Cpanel and start it again from scratch.

Perhaps your PC infected your website or vice versa.

Member Avatar for Chaky

That site just killed my Windows.

Forced it to shut down (not hardware shutdown!) and gives me BSOD on every bootup since. I had to install temporary windows on other drive. (Sick *&&^$#)

Right now I'm trying to figure out how to revert the situation.

In the mean-time but this link should be TERMINATED RIGHT AWAY!!!!

Member Avatar for chand.

That site just killed my Windows.

Forced it to shut down (not hardware shutdown!) and gives me BSOD on every bootup since. I had to install temporary windows on other drive. (Sick *&&^$#)

Right now I'm trying to figure out how to revert the situation.

In the mean-time but this link should be TERMINATED RIGHT AWAY!!!!

Now I realize that my desktop also sucked by it. It also shows often BSOD. Now tell me what I do just get rid from this domain or change the server. Its all crap, please tell me some technical things about the problem. I'm just going to take a class of service providers. crappy servers.

Member Avatar for Chaky

This is what I figured out so far:

This is what bitdefender got:
C:\WINDOWS\system32\dllcache\beep.sys Infected: Generic.Malware.P!.EAF3F10D
C:\WINDOWS\system32\dllcache\beep.sys Disinfection failed
C:\WINDOWS\system32\dllcache\beep.sys Moved
C:\WINDOWS\system32\dllcache\figaro.sys Infected: Generic.Malware.P!.EAF3F10D
C:\WINDOWS\system32\dllcache\figaro.sys Disinfection failed
C:\WINDOWS\system32\dllcache\figaro.sys Moved
C:\WINDOWS\system32\drivers\beep.sys Infected: Generic.Malware.P!.EAF3F10D
C:\WINDOWS\system32\drivers\beep.sys Disinfection failed
C:\WINDOWS\system32\drivers\beep.sys Moved

It replaced beep.sys which is being loaded even in safe mode. It is a driver for the beeper and is universal. The site triggers a flash animation and I suspect that the trojan is enbedded within the animation (little blobs following the mouse cursor). I don't think that the BSODs I expirianced was intentional by the malware creator. Seems like the BSOD is in low-level conflict with sptd.sys (came with daemon tools), because if I choosed not to load SPTD.SYS during safe mode bootup, then the safe mode would boot without BSOD, but the malware would be active and prevent me from dealing with it.

I removed (and restored original) beep.sys, but it still gives me BSOD on boot attempt... (work in progress)

Member Avatar for chand.

Yes the flash animation is what I upload it there, but if u just search in google about heady00 you might could find a clue about the problem.

the second searched item that you find looks like that as shown below.

hacked by OsmanliTIM
hacked by OsmanliTIM. ... Defacer: OsmanliTIM; Domain: <snip> IP address:<snip> ...
<snip> - Cached - Similar -

I also trying to know about this suck man, who is he.

Member Avatar for Chaky

Phiew...

Not that I'm blowing my own horn, but I've managed near-impossible. I've got rid of the trojans.
The battle was long and hard *khhh-khhhh*... the adversary was cunning and persistant... *khhhh*.. OK. Enough with the drama.

The damn thing was all over the hard disk. I had to install extra XP just to get a clean start and a hope of getting rid of the nasties. It kept replacing Beep.sys and NTFS.sys in System32\drivers and System32\dllcache folders, it kept creating Figaro.sys, hp32_nword.exe and several more startup nasties.... it took out my firewall, made Combofix not able to execute, it prevented me to do ANYTHING 'coz it would shut down windows almost immediately (logging on to my account = immediate shut down. Logging on to Administrator = 5 minutes to shut down)... gave me regular BSODs (apparently virtual drives + nasties = BSOD)...

In the end, this veteran OS install is 3 yo and counting :-)


I'm off now to tend to my sleep-deprivation.

Member Avatar for Rik_

That explains why I didn't get infected by that site. I have the security quite high on Flash animations. I only ever allow them on trusted sites.

chand, got to Cpanel - file manager, and you should be able to delete everything from your site safely.

Chaky, sleep well. :)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.