Linux Server Hacked

Question

I received e-mails from Google saying that my websites are hacked. This is the e-mail.

Dear site owner or webmaster of domain.com (I received this email for my other domains too), We recently discovered that some pages on your site look like a possible phishing attack, in which users are encouraged to give up sensitive information such as login credentials or banking information. We have removed the suspicious URLs from Google.com search results and have begun showing a warning page to users who visit these URLs in certain browsers that receive anti-phishing data from Google.

So I checked the web folders and I found in new folders with lots of folders in it.

Here are the folders

I have deleted all of them. Is there anything else should I do? Websites are Magento, Wordpress and HTML websites. Server is CentOS with Plesk 12.

Answer 1

The basic answer is that yes, you need to do more. You need to close the hole that allowed the attacker in in the first place. In addition, you need to remove any back doors, etc. the attacker added once he/she was in.

By far the most reliable way to remove the back doors is to wipe the system and restore from backup (making sure it's a backup from before the compromise). After that, you need to close the security holes—in your case, that probably means upgrading Magento and Wordpress.

Rather than repeating all the details here, I point you to several detailed answers on Server Fault: please see How do I deal with a compromised server? as well as Security Stack Exchange: How do I deal with a compromised server?