my website hijacked

[tsaint]

I have a website at www.worumba.com
If I point at an image, which is supposed to link to www.worumba.com/artwork/art.html, I see this address in the status bar. However, clicking the image takes me to :
http://brendarco.ru/original/index.php

I'm sure this arises from me originally adding an htaccess file, making the default somefile.html instead of default.html or index.html.
I set the permissions to 644. In the last few days, this file got changed (not by me) and hence the current problem.

 Ive deleted the htaccess file, I've tried replacing it with first a blank htaccess file, then a file with just a redirect for 404 errors, in case blank htaccess files didnt even get "looked at". However none of these fix the problem of redirection to a russian domain.
 
If I search for "worumba" in google, one of the returned links shows as www.worumba.stuff, but clicking it takes me to http://maildigi.ru/snipe/index.php

My 2 obvious questions are (a) how to fix this mess and (b) since the problem originated with my htaccess file (I think), what permission apart from 644 should I have used to prevent this happening in the future?
Thanks for reading this
tony

[Stoic Joker]

For what it's worth, you site works fine for me now. It is possible you may have a DNS issue - corrupt/invalid cached lookup somewhere between you and the server.

[wraith808]

For what it's worth, you site works fine for me now. It is possible you may have a DNS issue - corrupt/invalid cached lookup somewhere between you and the server.

-Stoic Joker (December 13, 2011, 09:47 PM)

It works fine for me, also.

[Paul Keith]

First link works fine but the second link made my Opera crash. (I don't know about websites though, just adding to what others have said.)

[tsaint]

thanks so much for testing for me.
 sadly, whilst the first link from the google search works fine, all the subheading links below the first heading - the worumba experience, About Mary and Lindsay,About Worumba Station,untitled - still send you to russia.
 Going directly to www.worumba.com works, but clicking on any links on that default page also directs to russia.

It's not just me, but for anyone. So the corrupted DNS explanation can't be right (I think, given I'm not knowledgeable about these matters)

[wraith808]

It's not just me, but for anyone. So the corrupted DNS explanation can't be right (I think, given I'm not knowledgeable about these matters)

-tsaint (December 14, 2011, 03:40 AM)

That's what I tried.  In fact, I clicked on all of the links on your site, and none of them went to russia.

[tsaint]

Thank you. Since the last time I posted, I found a lot of .htaccess files in various directories. I removed them all I think, but the site still was misbehaving for me. Checking just after seeing your reply, I found all to be working ok finally.
Again, thank you to everyone who took the trouble to check it out for me, it's much appreciated
tony

That's what I tried.  In fact, I clicked on all of the links on your site, and none of them went to russia.

-wraith808 (December 14, 2011, 04:11 AM)

[joiwind]

Jumping in at the end of this one.

Last night the servers that host my pop3 accounts and some of my domains were hacked and all the servers were down - my index pages were blank with just the words :

F***ed By : Secure-X41

I managed to get through to the company by hotmail and they are working 24/24 to get things back to normal for everyone, they said someone had accessed their servers through a site and I'm hoping it's not mine !

I searched using the above text as keywords and some weird stuff came up that I didn't want to follow - but has anyone heard of "Secure-X41" ?

[Carol Haynes]

Thank you. Since the last time I posted, I found a lot of .htaccess files in various directories. I removed them all I think, but the site still was misbehaving for me. Checking just after seeing your reply, I found all to be working ok finally.
Again, thank you to everyone who took the trouble to check it out for me, it's much appreciated
tony

That's what I tried.  In fact, I clicked on all of the links on your site, and none of them went to russia.

-wraith808 (December 14, 2011, 04:11 AM)

-tsaint (December 14, 2011, 05:10 AM)

Have you checked your own computer is not compromised - try doing a malware scan just in case your own computer is doing the redirecting.

[Shades]

In addition, open a 'DOS-box' and type in there:
IPCONFIG /flushdns

This cleans out DNS entries that your PC has been 'collecting' during your surf sessions. By default Windows stores these for 24 hours, if memory serves me right.

[tsaint]

Steps I've taken...
1. scanned MY computer. Since other people reported the hijacking, didnt expect this to fix anything
2. Replaced all instances of hacked htaccess files with a benign versions. The hacked ones returned and I replaced them again.
3. Checked all htaccess files were chmodded to 644.
4. Changed control panel and ftp passwords
5. Flushed DNS as per advice.

Last check shows all is normal but I'll be interested (nay, scared!) to see what the morning brings.
Again, thanks for the interest and suggestions
tony
Edit: I just rechecked. With firefox and opera,  the site works fine. With chrome, I get the russian redirect behaviour. I've cleared browsing data in all.

[Carol Haynes]

Using Chrome here found no issues - do you use Chrome Sync? Wonder if there is any caching going on in there?

[J-Mac]

Domain parent and all internal links working correctly in Chrome here.  4:34 PM EST  (UTC-5 hrs)

Jim