I saw the code - Files 403.shtml, I think the index page is compromised. How can I save myself from this hack?
My website has been hacked lately and it has been defaced. Now I have weird files, and don't know where they are coming from. I just want to know, what of these files are harmful or can cause that I get hacked again.
The .htaccess contains the following code:
order allow,deny
allow from all
deny from 121.54.58.159
The file .wysiwygPro_preview_eacf331f0ffc35d4b482f1d15a887d3b.php contains the following code:
// display the HTML code:
echo stripslashes($_POST['wproPreviewHTML']);
?>
It is not definitely malware. At least, not in the sense it's intended for malicious reasons... In the case you are using cpanel and you have used its IP Deny Manager to block access to 121.54.58.159 then this will automatically be written to your .htaccess file with the intended purpose of blocking that IP (and any others you may wish to enter)
order allow, deny allow from all deny from 121.54.58.159