possible website infection

[markscatesphotographyParticipant]

In late august I was getting a peak of 3000 impressions per day. I’m now getting like 60 per day. Its like my site has just died. I looked in the google webmaster tools at the search queries and it lists “ferronetwork” as a search query. When you look at ferronetwork it is a por* site. Further down the list there are other por* sites. If you click on the ferronetwork link in search queries it suggests a link to my network page http://www.picture5479.com/symbiostock-network/

If you click on the ferronetwork link in search queries you see this

I then did some research on these search queries and found that it suggests that my htacess file has been hacked.

http://webmasters.stackexchange.com/questions/53853/google-webmaster-tools-reports-porn-search-queries-are-showing-my-site

Sorry for the long post. Maybe someone could help me shed some light on this.

[ChristineParticipant]

Do a search for, google disavow links , I started with the help file within webmaster tools, not tried it yet as only have one bad site linking to me. They appear to have a clumber spaniel with (I probably do not want to know) and are linking to cocker spaniel puppy, so it is not suggestive keywords they are linking to

http://kerioakimaging.com - trying to reopen
http://nail-art-at.kerioak.com - Art and Nail Art

[LeoParticipant]

You’ve got a serious problem there! Change all of your passwords (cpanel / wordpress) and delete all of your users (except yourself) and make sure you do reset FTP passwords as well.

[LeoParticipant]

Also you may wish to call up your host – usually they can see how the intrusion happened.

[SemmickPhotoParticipant]

I was about to send you a PM before I read this because I got a twitter PM from you with a spam link about making money with my PC. I think you have a security breach considering your Twitter also seems to have been hacked.

[LeoParticipant]

So did you get any info on how to make money with a PC? I’ve been looking for a way to do that.

[SemmickPhotoParticipant]

Yeah, it pointed me to my sybiostock site… booyaaaaa

[markscatesphotographyParticipant]

Thanks for the info, as a precaution I’m going to remove myself from the network as a temporary measure.

[marthamarksParticipant]

Wow, Mark, this is a real shame! I’m so sorry you have to deal with this.

Is there any way we can protect ourselves from hackers like this, other than to guard our PWs and change them frequently?

And… could this be the reason so many of us saw a drop in traffic around the middle of Sept? Should we all be looking for that same “intruder”?

[markscatesphotographyParticipant]

@cathyslife stockphotos wrote:

Im going to have a look tonight, for sure. Sorry you got hit, Mark.

Thanks, I’m a bit confused. I have run several website scans and they are all clear?
I paid for the sucuri scan and that so far is clear,

I also looked at the htacess fil in the public_html directory and that is clean, no sign of infection there. At the moment I have emptied my network list so that I dont link to anyone.

Blue host are zero help on this one! They dont want to know. They do a simple scan and they say that its clear. If you press for more, they just ignore you on chat. They really don’t want to get involved.

I have followed Leo’s advice regarding passwords.

I went into google webmasters and downladed the table of links, none of the por* sites are anywhere to be seen. They only seem to be in the search queries.

To be honest I dont really understand much of this technical stuff.

All of the sites seem to point to http://www.picture5479.com/symbiostock-network

If anyone can shine some light on this let me know here or email me at markscatesphotography@yahoo.co.uk

Kind regards
Mark

[markscatesphotographyParticipant]

Should I disavow the sites that are in the search queries?

[ChristineParticipant]

I did, I created a file I called disavow.txt and uploaded that

http://kerioakimaging.com - trying to reopen
http://nail-art-at.kerioak.com - Art and Nail Art

[sandorgoraParticipant]

it’s known that Filezilla FTP can infect your websites by a trojan; i had it a time ago (not on SYS yet but all of my other sites)
advice: use Filezilla, chose not “normal” but “ask password” and don’t save your FTP password in Filezilla.
here is a link about that: http://blog.unmaskparasites.com/2009/09/01/beware-filezilla-doesnt-protect-your-ftp-passwords/

[markscatesphotographyParticipant]

@sandorgora wrote:

it’s known that Filezilla FTP can infect your websites by a trojan; i had it a time ago (not on SYS yet but all of my other sites)
advice: use Filezilla, chose not “normal” but “ask password” and don’t save your FTP password in Filezilla.
here is a link about that: http://blog.unmaskparasites.com/2009/09/01/beware-filezilla-doesnt-protect-your-ftp-passwords/

Thanks, thats useful

[markscatesphotographyParticipant]

The site has no malware apparently

[Author]

Posts