Cleaning Cloaked Site

Forum Moderators: open

Message Too Old, No Replies

Cleaning Cloaked Site

How do I remove links to external sites placed on my site by interlopers?

jplill

3:55 pm on Feb 22, 2011 (gmt 0)

Somebody implanted links on my website to their horrible spammy viagra/cialis sites. These links are revealed when I use the Fetch as Googlebot option in Google's webmaster tools, as well as when I run a site: query on google.com.

How do I clean these from my site? They don't show up in my code, so I can't just delete them. Is there a tool I can run to disinfect my site? It's running on a shared server at bluehost.

Any help greatly appreciated.

topr8

2:47 pm on Feb 25, 2011 (gmt 0)

check to see if there is anything in .htaccess that you don't recognise.

otherwise the best solution is to contact your host and ask them - the entire server could have been hacked not just you, and if that is the case just move hosts.

JohnRoy

9:23 pm on Mar 9, 2011 (gmt 0)

if that is the case just move hosts.

Move to where? to the host who's next in line to be hacked?! -

If your host does not provide the service needed, move.

Otherwise, let them solve the problem for you.

SteveWh

3:40 am on Mar 10, 2011 (gmt 0)

Something in your site is testing whether the request is coming from googlebot, and serving alternate content if it is.

That can be done in .htaccess. Check your .htaccess for redirect code. Also search for new .htaccess files that aren't supposed to be there.

It can also be done by a malicious .php script embedded somewhere in your site. It would have to be in a script invoked for every page load; for example, a header or include file.

If your site is not just showing "links" but also the drug sales pages, it's possible the hackers have embedded their entire drug website inside your site, possibly bundled into a single big .php script with the contents base64_encoded to make it harder to find with text searches.