Hack cleanup: Removed inserted plugins, still can't clean redirect
-
Had the joy of my first Content Injection hack this week. Needless to say, it’s been a nightmare to clean up.
Thanks to Wordfence, I found the guilty PHP that the hackers had installed that injected spammy content and redirects for google to find — which of course they did, which is how if found out.
Here’s a list of what I’ve done:
1) Installed Wordfence Premium, adjusted firewall settings and scanned repeatedly to delete two nasty PHPs, including one called compartmentalize-casements.php, which apparently is what pulled the spam from offsite.
2) Reinstalled pre-hack backup data, plugin and other files via UpdraftPlus.
3) Tested, tested and retested the site.My problem? The site now doesn’t feed spam, and still runs fine to the viewer. But crawlers like googlebot and bing can’t see the pages or read my robots.txt files, because something is still installed trying to send them to the offsite spam-feeder.
Here’s a transcript from the Bingbot:
TTP/1.1 404 Not Found
Connection: Keep-Alive
Date: Mon, 29 Feb 2016 23:09:04 GMT
Keep-Alive: timeout=5, max=100
Content-Length: 413
Content-Type: text/html; charset=iso-8859-1
Server: Apache<!DOCTYPE HTML PUBLIC “-//IETF//DTD HTML 2.0//EN”>
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL /compartmentalize-casements.php was not found on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
<hr>
<address>Apache Server at phineasswann.com Port 80</address>
</body></html>Anyone have any ideas of where I might find the code that’s generating this? I’m not a PHP programmer, so I don’t know if it might be somewhere in a CSS stylesheet or somewhere else.
Word fence scans are telling me I’m clean, but clearly there’s something still left behind that’s directing the crawlers away from the true page content.
- The topic ‘Hack cleanup: Removed inserted plugins, still can't clean redirect’ is closed to new replies.
