[primcrafter]

I recently noticed that my website was hacked and now when users/visitors go to my website there is a popup asking for username and password like as in an .htaccess file but I can't seem to find where it's coming from (which file) or how to remove it. Then after it's removed how do I secure my website from hackers?

My website is http://www.handcraftershowcase.com

Please can someone help?

[primcrafter]

Here is a screen shot of what I'm talking about. I also notice the website is slow as well.

[Rockn]

Where is your web site hosted? Ask the hosting company to scan your files and maybe they have a suggestion as to how to secure it better.

[primcrafter]

I can ask but it's not a virus or trojan but someone hacked the site, is there a free website scanner that could find that?

[Squashman]

So you don't keep your entire site backed up to your computer locally. Could your just re-upload everything?

If there was an .htaccess file you would see it in the root of the directory.

Does your webhost provide log files for you?

[primcrafter]

I do but the latest backup also has that hacked file in it

I also have an .htaccess file but it's a redirect and I deleted it last night and made a new one because I noticed some weird stuff in it and I thought that was the issue but I still see the popup login box.

As for log files, I have cpanel, could I find them in there?

[Squashman]

Originally Posted by primcrafter

I can ask but it's not a virus or trojan but someone hacked the site, is there a free website scanner that could find that?

Did a Google search for you.
http://www.google.com/#hl=en&q=scan+...malicious+code
http://thepcsecurity.com/scan-or-che...-4-free-tools/

[Squashman]

Originally Posted by primcrafter

I do but the latest backup also has that hacked file in it

Now you are confusing me. You know the hacked file is in your backup but you don't know what file it is?
You don't have incremental backups of your website? How is your website updated? Do you update it on the web and then back it up to your computer?

Let me see the contents of your .htaccess. I would also look for multiple .htaccess files on your site. I see the redirect going to the MALL folder but is there an .htaccess file in the mall folder as well.

[Squashman]

You may want to ask a moderator to move this thread to Web Design & Development.

[primcrafter]

Well I am not sure which file it is as I am newbie with being hacked but the recent backup I did, I downloaded it and restored it through my cpanel and still the popup box is showing.

I dont have the previous .htaccess file since I deleted it.

[Rockn]

Scanning the web site would not fix the issue anyway and it is physically impossible to scan the file system of a web server. Your hosting company should have backups unless you are hosting it.

How are you even sure the .htaccess file has been compromised?

[apr911]

The .htaccess file prompt is coming from the image for Grubby Dipped Rag Balls

<img src="http://ltd-suppport.net/aDmin/thu roai/thu roai/c99.php" alt="Grubby Dipped Rag Balls" title="Grubby Dipped Rag Balls">


In the future, you can determine this yourself. If the page is loading and then you get the .htaccess, then it is something being loaded within the page. If the page does not load at all and you get the .htaccess then it is a configuration issue on your webserver.

The .htaccess prompt tells you the root site requesting the user/password. You can then simply search your code for that site.

In this case the .htaccess specified the domain as http://ltd-suppport.net. A quick search of your code returned the above image and when looking on the site for that image I could see it was indeed, not loading.

-APR911

[simonb89]

Nothing beats manual pentests but Accunetix makes a web scanner that does a pretty good job discovering website vulns. http://www.acunetix.com

[Sequal7]

The problem has nothing to do with your .htaccess or your website, it is the site who's image your "borrowing" (to be polite) from (http://ltd-suppport.net/aDmin/thu roai/thu roai/c99.php) that denies the image from being shown, and since you linked to it, your site is requesting the credentials to display that image.

Remove the images and your site will act normally....

SIDE NOTE: Copyright infringement is something that shouldn't be assisted with on here though, so if you don't own rights to the image, then really, don't ask to help display it. People protect from "hotlinking" so others don't take their images etc and steal bandwidth....