3 replies
Hi guys, this might be a long thread so bear with me

This specific domain had an outdated theme and for a year or so and wasnt able to monitor it.
Just recently got emails from google saying the site had unsafe content for users.
Then another one from mcafe .. same thing, then hostgator notified me that my bandwidth had reached its limits how ironic ... my host couldnt detect such unusual activity.

That was a red flag... immediately looked into it and found a huge folder of 23 GB incejted into my server. Mainly containing html files and pdfs in Russian.
Checked with webmaster tools and found 2400 porn site links directing to my site
Called hostgator ( since they have sold the company the service has really downgraded, not only they do not perform scans but their customer reps are really newbies. I had to threaten them i was going to close the accounts so they could do a scan)
Deleted my self all suspicious files (its a wordpress site) and also the plugin files compromised. NOT SURE IF THE SITE IS CLEAN NOW.

Re indexedthe site with google and the problem now is:
Server error 9,226
47 Access denied
116,629 Other permanent 404

If i search on google site:mydomain.com to see my indexed files by google
I see results in this fomat domain.com/__iaa4ws8t895hdzzy7b3 and as a description unrelated content
When you click on them seems as the porn link goes to my domain first then redirects you to a porn site.

If i dont fix this right away i will be F***ed with google
















#hacked #site
  • Profile picture of the author Jill Carpenter
    LOL.

    Sorry, just massive wall of text there.

    Question 1: Is or was the site making you money?

    Question 2: Can you log into the backend of that site now?

    Question 3: Does your host have a backup of your server they can go back to a time when those files were not on there?

    Those indexed pages may take some time to go away.
    Signature

    "May I have ten thousand marbles, please?"

    {{ DiscussionBoard.errors[10456125].message }}
    • Profile picture of the author massonspy
      =Jill Carpenter;10456125]LOL.

      Sorry, just massive wall of text there. SORRY COULDNT UPLOAD

      Question 1: Is or was the site making you money?YES ITS A LEGIT BUSINESS SITE

      Question 2: Can you log into the backend of that site now? YES

      Question 3: Does your host have a backup of your server they can go back to a time when those files were not on there? NOPE

      Those indexed pages may take some time to go away. WHAT IF I REINSTALL THE SITE FROM SCRATCH AND KEEP THE EXACT SAME LINKS
      {{ DiscussionBoard.errors[10456131].message }}
      • Profile picture of the author Jill Carpenter
        I'm not confident there isn't some kind of worm/trojan or something in there regenerating those results.

        I had an issue like this where every time I deleted the bad files they would reappear again in minutes.

        I had way too many domains to bother wanting to call in a service to do the clean up so I nuked the server and started fresh at the time.

        Is there a lot of other stuff on the server?

        You have clean backups of everything to reinstall?

        If it's just a site or two and you have clean copies of everything, give er a nuke.

        Then come back and tell me what security plugin(s) you are using.

        If the theme can not be updated you may have to change it all together.
        Signature

        "May I have ten thousand marbles, please?"

        {{ DiscussionBoard.errors[10456138].message }}

Trending Topics