I received e-mails from Google saying that my websites are hacked. This is the e-mail.

Dear site owner or webmaster of domain.com (I received this email for my other domains too), We recently discovered that some pages on your site look like a possible phishing attack, in which users are encouraged to give up sensitive information such as login credentials or banking information. We have removed the suspicious URLs from Google.com search results and have begun showing a warning page to users who visit these URLs in certain browsers that receive anti-phishing data from Google.

So I checked the web folders and I found in new folders with lots of folders in it.

Here are the folders

enter image description here

I have deleted all of them. Is there anything else should I do? Websites are Magento, Wordpress and HTML websites. Server is CentOS with Plesk 12.


1 Answer 1


The basic answer is that yes, you need to do more. You need to close the hole that allowed the attacker in in the first place. In addition, you need to remove any back doors, etc. the attacker added once he/she was in.

By far the most reliable way to remove the back doors is to wipe the system and restore from backup (making sure it's a backup from before the compromise). After that, you need to close the security holes—in your case, that probably means upgrading Magento and Wordpress.

Rather than repeating all the details here, I point you to several detailed answers on Server Fault: please see How do I deal with a compromised server? as well as Security Stack Exchange: How do I deal with a compromised server?

  • will scanning with clamav or any other similar software help this problem? Thank for your help by the way.
    – Erdem Ece
    Mar 8, 2015 at 19:07
  • @ErdemEce not really. It might detect known malware (presuming it isn't hidden by a rootkit), but can't find anything not in its database. Like the edits to your php files will likely be. See "Why not just "repair" the exploit or rootkit you've detected and put the system back online?" in the linked question.
    – derobert
    Mar 9, 2015 at 12:16

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .