Was my site hacked?

  • Resolved lzr0

    (@lzr0)


    3 years, 8 months ago

    Hi,
    When I click on the link to my page in google search results in chrome for query how to wire a 4 prong generator plug to a 3 prong plug (my page is usually #1 or #2 in search results page), it redirects to some online pharmacy. However, when I open my homepage and navigate to the same page from the homepage, it shows my page correctly.
    I wonder if my site is hacked and if it does, what should do about it?
    WP5.7 php5.6.
    Thanks.

    • This topic was modified 3 years, 8 months ago by lzr0.

    The page I need help with: [log in to see the link]

Viewing 10 replies - 1 through 10 (of 10 total)
  • Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    Yes. See https://sitecheck.sucuri.net/results/www.generatorsforhomeuse.us/connect-generator-to-home/

    Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

    Thread Starter lzr0

    (@lzr0)

    Hi, Steven,
    Thank you. Before I go over all the suggestions, I found this code in my htaccess. Is it supposed to be there?

    RewriteEngine On

RewriteBase /
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
RewriteCond %{HTTP_HOST} generatorsforhomeuse\.us$
RewriteRule . blundered-cochineal.php [L,S=10000]
    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    That’s part of the hack, so make a note to remove .htaccess and regenerate it as part of the cleaning. Make sure you also find and delete “blundered-cochineal.php”

    Thread Starter lzr0

    (@lzr0)

    Steven,
    Will WP auto generate a new ‘htaccess if I just delete it?

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    Go to settings> perms links and click save.

    Thread Starter lzr0

    (@lzr0)

    Steven,
    htaccess restore and blundered-cochineal.php deleting removed the malware. I now also installed wordfence. Thank you for the help.

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    If that’s all you did, the malware is probably not gone.

    Thread Starter lzr0

    (@lzr0)

    If that’s all you did, the malware is probably not gone.

    Sitecheck shows clean and it no longer redirects. I also found a virus in my PC and had it removed

    • This reply was modified 3 years, 8 months ago by lzr0.
    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    Did you do a full “scan everything” scan with WordFence?

    Thread Starter lzr0

    (@lzr0)

    Did you do a full “scan everything” scan with WordFence?

    Now when said it, I run Hi sensitivity scan, and it did find a bunch of suspicious php files, which I deleted.

Viewing 10 replies - 1 through 10 (of 10 total)
  • The topic ‘Was my site hacked?’ is closed to new replies.