Problem with Google search, or website?

[Penn]

I have been having a problem with a couple of websites in the last couple of weeks. Basically when you search Google for these two particular websites, the search findings are rather suspicious. The two websites in question are g0vqy.co.uk and Torbayads4free.co.uk. The heading and description that Google are now displaying would indicate the websites have been hacked. However when you actually go to the website nothing seems to be out of place, the description and headings are there and nothing else has been put in its place. I checked the source code and can't find anything suspicious there either. However, you can't access the homepage from Firefox, you just get an error, all other pages seemed okay. But if you go to chrome, you still get the problem with the description and the heading, but you can get to the website by clicking on the link.

The easiest way to explain what I'm talking about is for you to try it yourself

Please search for "G0VQY" g0vqy.co.uk
" " "Torbay free ads" Torbayads4free.co.uk

I would appreciate your opinion on whether or not the site has been compromised somehow, or If something else is causing the problem. By the way, I'm using Joomla! 1.5 .26. I was using 1.5 .25 when the problem started happening.

[illya]

I don't see ant problems in firefox.

but when I put Torbayads4free into google I get this under your URL

hou to purchase online and download oem programs.

And the google cache link...

well see for yourself looks kinda spammy...

[Penn]

Yes, this is exactly what I have been getting the last week or so. Somebody on the Joomla! forum reckons that the websites have been hacked. However, I can't find any evidence of this. I know that Google must be getting its information from somewhere, but where? that is what I can't work out. Everything looks in place, descriptions and headings look okay, they have been modified on the website at all. I have looked in various files but I still can't find where this information could have been added so that Google is indexing it, it's doing my head in.

What is puzzling me is when you do a search for G0VQY and find G0VQY.CO.UK, it doesn't go anywhere unless you put a trailing slash at the end of the URL

[Penn]

I think I have the problem, in the end I distinctly uploaded some fresh files and it seems as though it has cured the problem. Hopefully Google will reindex the websites in a few days time and everything will go back to normal

[bluemi]

Penn, do you have a .htaccess file? And did you upload the one from your computer yesterday? Then you have only temporarily fixed the problem. This sounds to me like what I had a while ago which is a .htaccess hack. The site shows up fine for you but all traffic that is coming from search engines is redirected to some Russian or other website. It is a nasty thing since you normally don't open your website via Google or another search engine.
Check what installations you have on the server and if one of them needs to be updated. In my case it was an outdated Zenphoto installation which allowed the hacker to get in.

[Penn]

Penn, do you have a .htaccess file? And did you upload the one from your computer yesterday? Then you have only temporarily fixed the problem. This sounds to me like what I had a while ago which is a .htaccess hack. The site shows up fine for you but all traffic that is coming from search engines is redirected to some Russian or other website. It is a nasty thing since you normally don't open your website via Google or another search engine.
Check what installations you have on the server and if one of them needs to be updated. In my case it was an outdated Zenphoto installation which allowed the hacker to get in.

It's an up to date installation. Also, you've just reminded me that I need to change the htaccess.txt to .htaccess. As far as I can tell this was the problem, the file hadn't been modified in a while and I couldn't see any suspicious content within the .htaccess.

[bluemi]

Hm, did you check the actual .htaccess file on the server?

[Penn]

Yes, I do have a .htaccess file on the server, actually there is one in all of my websites. Strange thing is, I normally have to change the htaccess.txt to .htaccess, but using Filezilla I can see there was one there are already. I had already updated my Joomla! websites to the latest version of 1.5. I then downloaded a full installation of the latest version of 1.5, took the files from it, deleted the existing files on my server and then replaced them with the new files from the new installation, of course I made a backup copy of my configuration.php and uploaded this after. So really all the files are completely new taken from a new installation. Just not sure whether the .htaccess is created automatically. I was always under the impression that you had to create that yourself, it does say in the back end of Joomla! that you have to change htaccess.txt if you are going to use search engine friendly URLs on an Apache server.

[illya]

Do you have root access.
you could try

grep -r "hou to purchase online and download oem programs" directory

directory meaning public_html or www


you can replace "hou to purchase online and download oem programs" with other perimeters

"Cyberlink DVD Suite 5 Pro cost of"

Sounds to me like a virus and not a fresh install

I would be asking myself where did I download it from..



Updates don't necessarily replace all files

[Penn]

I'm not really understanding what you're getting at. After I replaced the files with fresh ones, the website is now redirecting as it should do, I am not getting any error pages. It's just a case of waiting for Google to reindex the two homepages. I don't see any evidence that suggests that I have a virus. Of course if you think I still have then could you be a bit more specific about your suspicions?