Anybody else been hijacked by google metatags?

Yes, the source code shows the right description. Under metadescription is the normal desription the one it should show. But in google, the description is something about iPhones.
 
Advertise on BHW
Well guys I tried asking around on other forums too. All I get are some general assumptions.

Can anyone advise how I should proceed to handle this? What would you do if it happened to you?
 
do a server backup.

Always update your wordpress. Its open source so its prone to this stuff, has happened to me a few times.
 
Another thing to check is to clear your DNS cache on your computer:

ipconfig /flushdns

Then try again...
 
Backberry: I flushed my DNS, still the same meta description. Thanks for your ideas

netpal: Which files exactly?

badman2: I am running the newest version of wordpress.. Do you say I should restore? Is there another solution?
 
So right now I am Aptying the tables of the plugins which I've last installed. Hopefully this might fix it if there is any bad code in them.
 
1) back up everything you have.
2) check your htaccess, sometimes all it is is just redirects and code placed into that from a simple server hack
3) go here
Code: 
http://codex.wordpress.org/FAQ_My_site_was_hacked
 
Verify the meta on your site not on googley
1. Go to your cpanel and search in the myqsl database the redirect link and delete that shit
2. Else verify your theme, delete the install, the security WP plugins are shit. Install WP again, point it to the old database, then verify the meta on your site.
 
Reinstall from your backup. You're backuping your stuff, aren't you? :umbrella:

If not reinstall wordpress and the plugins from the scratch (I would use another computer, or a reinstall windows as well. Personaly I'm using Linux to run my internet business, so I'm rather safe from local infections) and use the same database. If it doesn't help get someone who knows wordpress and php to get things cleaned.

D.
 
ADHD-Dude & Fwiffo:

So I opened my Htaccess file (which was supposed to be protected by Bulletproff security) and I found some shady redirects and overwrites mixed in with my W3 Total Cache plugin's commands. Since I am not using the plugin anymore, I deleted everything.

Now I am waiting in on the results, hopefully they are good.

If it doesn't work, I am trying ADHD's database method. Though I have to day that I already installed a DB manager plugin and I emptied all suspicious databases that I didn't need.

@Everyone: How do I protect my website from getting hit again? Obviously Bulletproff didn't do a good job...
 
So I can say for sure that Bluehost didn't give a shit about this problem, nor did they know what to do. I have been told they are crap, but now I know first hand. Which do you guys think is the safest *not cheapes* hosting? Maybe the one thepiratebay are on lol
 
Ok guys, here is the HTACCESS code right here. Do you see anything strange?

Code: 
# Use PHP5 Single php.ini as default
AddHandler application/x-httpd-php5s .php


# BEGIN W3TC Browser Cache
<IfModule mod_deflate.c>
    <IfModule mod_setenvif.c>
        BrowserMatch ^Mozilla/4 gzip-only-text/html
        BrowserMatch ^Mozilla/4\.0[678] no-gzip
        BrowserMatch \bMSIE !no-gzip !gzip-only-text/html
        BrowserMatch \bMSI[E] !no-gzip !gzip-only-text/html
    </IfModule>
    <IfModule mod_headers.c>
        Header append Vary User-Agent env=!dont-vary
    </IfModule>
    <IfModule mod_filter.c>
        AddOutputFilterByType DEFLATE text/css application/x-javascript text/x-component text/html text/richtext image/svg+xml text/plain text/xsd text/xsl text/xml image/x-icon
    </IfModule>
</IfModule>
<FilesMatch "\.(css|js|htc|CSS|JS|HTC)$">
    FileETag None
    <IfModule mod_headers.c>
         Header set X-Powered-By "W3 Total Cache/0.9.2.4"
    </IfModule>
</FilesMatch>
<FilesMatch "\.(html|htm|rtf|rtx|svg|svgz|txt|xsd|xsl|xml|HTML|HTM|RTF|RTX|SVG|SVGZ|TXT|XSD|XSL|XML)$">
    FileETag None
    <IfModule mod_headers.c>
         Header set X-Powered-By "W3 Total Cache/0.9.2.4"
    </IfModule>
</FilesMatch>
<FilesMatch "\.(asf|asx|wax|wmv|wmx|avi|bmp|class|divx|doc|docx|eot|exe|gif|gz|gzip|ico|jpg|jpeg|jpe|mdb|mid|midi|mov|qt|mp3|m4a|mp4|m4v|mpeg|mpg|mpe|mpp|otf|odb|odc|odf|odg|odp|ods|odt|ogg|pdf|png|pot|pps|ppt|pptx|ra|ram|svg|svgz|swf|tar|tif|tiff|ttf|ttc|wav|wma|wri|xla|xls|xlsx|xlt|xlw|zip|ASF|ASX|WAX|WMV|WMX|AVI|BMP|CLASS|DIVX|DOC|DOCX|EOT|EXE|GIF|GZ|GZIP|ICO|JPG|JPEG|JPE|MDB|MID|MIDI|MOV|QT|MP3|M4A|MP4|M4V|MPEG|MPG|MPE|MPP|OTF|ODB|ODC|ODF|ODG|ODP|ODS|ODT|OGG|PDF|PNG|POT|PPS|PPT|PPTX|RA|RAM|SVG|SVGZ|SWF|TAR|TIF|TIFF|TTF|TTC|WAV|WMA|WRI|XLA|XLS|XLSX|XLT|XLW|ZIP)$">
    FileETag None
    <IfModule mod_headers.c>
         Header set X-Powered-By "W3 Total Cache/0.9.2.4"
    </IfModule>
</FilesMatch>
# END W3TC Browser Cache
# BEGIN W3TC Page Cache core
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /
    RewriteRule ^(.*\/)?w3tc_rewrite_test$ $1?w3tc_rewrite_test=1 [L]
    RewriteCond %{HTTP:Accept-Encoding} gzip
    RewriteRule .* - [E=W3TC_ENC:_gzip]
    RewriteCond %{REQUEST_METHOD} !=POST
    RewriteCond %{QUERY_STRING} =""
    RewriteCond %{HTTP_HOST} =www.romanistika.org
    RewriteCond %{REQUEST_URI} \/$ [OR]
    RewriteCond %{REQUEST_URI} (sitemap(_index)?\.xml(\.gz)?|[a-z0-9_\-]+-sitemap([0-9]+)?\.xml(\.gz)?) [NC]
    RewriteCond %{REQUEST_URI} !(\/wp-admin\/|\/xmlrpc.php|\/wp-(app|cron|login|register|mail)\.php|\/feed\/|wp-.*\.php|index\.php) [NC,OR]
    RewriteCond %{REQUEST_URI} (wp-comments-popup\.php|wp-links-opml\.php|wp-locations\.php) [NC]
    RewriteCond %{HTTP_COOKIE} !(comment_author|wp-postpass|wordpress_\[a-f0-9\]\+|wordpress_logged_in) [NC]
    RewriteCond %{HTTP_USER_AGENT} !(W3\ Total\ Cache/0\.9\.2\.4) [NC]
    RewriteCond "%{DOCUMENT_ROOT}/wp-content/w3tc/pgcache/%{REQUEST_URI}/_index%{ENV:W3TC_UA}%{ENV:W3TC_REF}%{ENV:W3TC_SSL}.html%{ENV:W3TC_ENC}" -f
    RewriteRule .* "/wp-content/w3tc/pgcache/%{REQUEST_URI}/_index%{ENV:W3TC_UA}%{ENV:W3TC_REF}%{ENV:W3TC_SSL}.html%{ENV:W3TC_ENC}" [L]
</IfModule>
# END W3TC Page Cache core
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>


# END WordPress
# WP-AVOID-SLOW Begin
# Add Expires headers
ExpiresActive On
ExpiresDefault "access plus 5 days"
# ETags
FileETag none
# WP-AVOID-SLOW END

I basically removed the cache plugin's data, but it rewrote itself now that i check 5 minutes later. Maybe the problem isn't here? Can somebody who knows these files tell me if the problem is here?

Thanks!
 
It amazes me how people are so lazy they'd rather hack a site then do their own SEO. My sites have been hacked, redirected, malware installed (so search engine results show "illegal download" in big red letters. Try getting traffic with that. Takes 6-8 weeks after cleaning it out to get search results with no edit...still some pages come up when checking even 12 weeks later. ddos attacks and a few other things. Only happens when you are page 1 of course.

Hire a freelancer to go in each site and clean it out, they can do it on a per site fee. That's the only way to make sure everything is clean. Then back everything up and watch any themes and plugins you use. Never download any plugins or themes that are nulled. The latest is someone put some subdomain phishing files on my site and the server contacted me after receiving complaints. Even after turning the server over to a management company who hardened everything they still got in and place 2 folders onto the domain. But they fixed that now i think also. Wordpress is great with all the things you can do with it, but it does suck none of my html sites have issues. Did i mention they were using 2 of my wordpress sites to send out 20k emails per day. Ruined the ip of course. It just ends up making me put things in place that should've been there before, better security and when I hit page one there's nothing they can do that hasn't already been done or at least tried. Also, backups are good cause they spend all the time trying to screw it up, and in a couple minutes it's back up, clean and holes are plugged. lol
 
Last edited:
Have you checked the timthumb exploit? Could be this.

Also when updating anything, disable the total cache plugin. Only re enable that once you've sorted the issue, otherwise you'll be changing things that do make a difference but not seeing them.
 
Skywalker:

Thanks for sharing your story. Can you recommend me a freelancer service like that please? Also, what hosting do you use for maximum protection, and do you use any security plugins?

I am really devastated by this whole happening, its cost me a lot of money, and it really is a shame people destroy businesses instead of building their own. I deleted my htaccess, checked my DB, but google still has my site cached with the wrong info.

I have downloaded all the files - backuo, database, posts. Ready to restore if tomorrow the wrong meta is still up. Can you please recommend me a good and SAFE way to restore? Lol, I don't think I can handle the restore failing.

Thanks for your help!
 
Last year, I had some of my site hacked in similar fashion.
Those were sites which I didn't update to latest version of WP. If your site was hacked before you updated Wordpress version, then you should check your database for abnormal entries.
In my case there was an extra user created with admin rights.

I had backup of my wordpress xml file. So what did was to delete the mySQL database, made a fresh installation of wordpress and imported the posts from backup. I had to install all the plugins fresh. It takes little bit of extra time. But will save you hours of frustration.

By the way, make sure that your backup is clean with no additional users or extra entries.
 
Your password may have been stolen from Filezilla FTP client.

I believe you have been hit by the black hole virus. I got it few months back, i had to delete the website i was working on.... it is a pleg !

The only antivirus which back at the time was able to detect it on my computer was AVG. On my website i gave up as the whole code was corrupted by this encoded code and even Cpanel system files was affected.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top