google WTF !

[findtim]

"This site may be hacked."

I have a VERY valid site, its been running 8 years and we do NOTHING wrong with it but for some reason this pops up today under the listing.

we have SSL on it and its receiving orders today

does anyone know whats gone wrong?

it wants us to validate the site which I have already done years ago, its a bricks and mortar.

I am SOOOOO sick of google RULING what I can do online at its whim.

tim, pissed off

 

[geodomains]

You may need someone to look at it for you. PM as I know a guy who helped me a couple of times.

Can be something that is not obvious.

Don

 

[James]

Could be ads you are running or malicious code on the site. I was running some affiliate ads on a site a few years ago and this showed I removed the ads and removed the hacked listing in Google. Some information below here:

http://www.google.com/webmasters/hacked/

This is a cross over of dev/ search specialist work.

 

[FirstPageResults]

Doesn't WMT send you emails about these kinds of things these days? Assuming you have WMT, does it have any messages under that account?

A few years back I had a similar thing happen to me, and it was because another site on the same IP (shared hosting) got hacked.

Also FYI a SSL cert does not prevent your site from getting infected with malware, it merely encrypts the browsers connection to the server. Most attacks on websites are carried out in different ways.

 

[nt81]

Bullshit aside, I think I may know what is going on.

When you search for the site in google, it will display like this :

If that is what you're seeing, someone has compromised the .htaccess file in the hosting folder. It will probably look something like this.

Fix up (clean) that .htaccess file and remove any traces of any other (dodgy) files it links to on your site.
Then wait for about a week (or use Webmaster Tools to force Google to re-index the site)

When they do their next index, it will go back to normal. I'veSeen this so many times in the past 3 months on clients hosting it isn't funny.

Usually comes from an INSECURE form on the website. They generally exploit the web form to upload files to the hosting. Web forms without capchas or validation are just asking for trouble.

HTH

 

[findtim]

well it turns out I did get hacked !, and thanks to everyone that gave advice via PM.

the hero was Chris who cleaned up the mess for me, just hoping he is kind on the invoice

I'm now in cleanup mode, it seems they created 2,600+ users which I have to get rid of but keep the real customers

and now to go through and do the same protocol with my other sites

thanks

tim

 

[nt81]

Glad to hear you got it sorted.

Nothing more annoying than finding some turd has messed with a site - especially if Google are the ones to let you know first!

 

[findtim]

so I should apologise to google.... sorry

just for reference this is the crap I am now deleting

http://screencast.com/t/b96ZBDIN

what's interesting is they created subscriber accounts but I didn't get any account request notifications as its set to be " no one can subscribe " ?

tim

 

[petermeadit]

What was the hack they used?

Do you have WordFence or some other security plugin?

so I should apologise to google.... sorry

just for reference this is the crap I am now deleting

http://screencast.com/t/b96ZBDIN

what's interesting is they created subscriber accounts but I didn't get any account request notifications as its set to be " no one can subscribe " ?

tim