Help! Hacked by Bristol Viagra - what's this?

If you speak to the host they should be able to backup from a previous install. If it's wordpress based make sure you are running at the latest version and have some security plugins to stop this happening again.

Speak to the host - they should be able to identify some malware.

Also change all passwords and do a virus scan on your local computer.

Remove all of your webspace, reload everythink using backup and check that all your files are write prodected. cu

Very strange about the ads -- however probably somehow google is 'guessing' that is what you want to talk about.

If you want to change the 'ad' type that google shows, you need to add this text:

<!-- google_ad_section_start -->


then your contextual "text", then

<!-- google_ad_section_end -->

Google will 'now' determine your ad type to be based on the text that you have there.

So you could write something like 'furry kittens, fluffy kittens, big cats', etc,
and all of the sudden your ads would be about cats.

John

I went to your site and everything seems to be OK. Nothing unusual like the screen shot above.

Maybe your site was hacked before. I don't know.

Before you do anything run a virus scan on your system and also check your system for keyloggers. It appears that they have access there fore they may have your FTP info to your site.

Goto your site and change your ftp login info.

Do not type in the info.

Type a line or two of random letters and numbers in note pad and then select a section of the text and copy/paste the new selected password into your ftp host account. make sure you write the selected text down on paper for later usage.

Keyloggers can't read a copy and paste function.

Hope that Helps,
Have a Great Day and Good Luck!
Michael

If you need help cleaning it up PM me an email address - I clean up hacked sites.

Wow, thanks for all the incredible good help here

I've contacted the webhost as recommended by flamingphoenix. As for uploading everything again, it can be done, but will take days, and the problem is that I cannot see anything wrong here.

Great tip, Michael Mayo, about copy and pasting new data to FTP.

My friend, who took the picture, is on a Linux computer and used Firefox 4. I'm on a Mac and have tried both with Firefox, Safari and Opera. I couldn't reproduce what he saw, but I still have the viagra ads.

I'll let you know what I find out, just in case another warrior encounters the same problem.

Hi all - I wanted to give you an update on the situation, which should now be under control.

I contacted Hostgator, who shortly after wrote back with a detailed list of files they had found contained malicious code in. Some of the files were from December last year, and we've just discovered that they were already there, when we moved from Dreamhost to Hostgator.

For that reason, Hostgator couldn't tell exactly how the files had entered the system, but it was likely through a forgotten blog that hadn't been updated, since we didn't use it anymore. It is now deleted completely.

Hostgator has changed our access password (ftp and sql), so we've now updated all the files that gave access to the database. We've probably forgotten some... but most of the work has been done

What I still don't understand is why my friend could see the viagra text, when everybody else couldn't. Maybe it's because he uses Linux? Maybe the code were meant to be shown only to search engines for lots of backlinks, and not to the human eye so that we would notice something was wrong?

Anyway, I really appreciated all your help and tips.

Check your sites through a proxyserver to see what they look like to others...