Descripción en Google hackeada

[Kiko das Leiras]

Boas,

Necesito axuda. Se escribides "surfgz.com" en Google aparece unha descripción da web hackeada e non atopo a solución.

Tedes unha imaxe adxunta onde aparece "IPHONE HACK" en troques de "SURFGZ". Que podo facer??

Como vedes a segunda entrada de Google é a correcta.

[Kiko das Leiras]

Tamén fixen un CONTROL+U e tenho esta info:

<h2 class=hd>Resultados da busca</h2><div><ol><!--m-->
<link rel=prefetch href="http://www.surfgz.com/"><li class=g><h3 class=r><a href="http://www.surfgz.com/" class=l onmousedown="return rwt(this,'','','res','1','AFQjCNGyW7L_08lQteLlpu68ZL37hkXn5A','&amp;sig2=HLSj_-JLfq4SZ6XG3MtAWg')">IPHONE HACK</a></h3>
<span class=m>&nbsp;<span dir=ltr>- 02:32</span></span><span class="std nobr">&nbsp;- [ <a href="http://translate.google.es/translate?hl=gl&amp;sl=en&amp;u=http://www.surfgz.com/&amp;ei=lNJySufgJN2ZjAeBsqW9Bw&amp;sa=X&amp;oi=translate&amp;resnum=1&amp;ct=result&amp;prev=/search%3Fq%3Dsurfgz%26hl%3Dgl%26sa%3DG" class=fl>Traducir esta páxina</a> ]</span><div class="s">OMER BHATTI google &middot; OMER BHATTI &middot; OMER BHATTI yahoo 10 Oct 2007 ... The iPhone Alley hack is a actually copy of an early team method that . <b>...</b>

<br><cite>www.<b>surfgz</b>.com/ - </cite><span class=gl><a href="http://209.85.229.132/search?q=cache:IlB_NMnKsfIJ:www.surfgz.com/+surfgz&amp;cd=1&amp;hl=gl&amp;ct=clnk&amp;gl=es" onmousedown="return rwt(this,'','','clnk','1','AFQjCNHL4pIn4H0XHEgJxO7SRgSGkyAyeQ','&amp;sig2=0IYo9KDG0RFB-Tw2157eFA')">En&nbsp;memoria</a> - <a href="/search?hl=gl&amp;q=related:www.surfgz.com/">Similares</a></span><br><table class=slk><tr><td><div><a href="/url?q=http://www.surfgz.com/index.php%3Foption%3Dcom_content%26view%3Darticle%26id%3D399:bodyboard-en-balcobo%26catid%3D71:bugueirs%26Itemid%3D151&amp;ei=lNJySufgJN2ZjAeBsqW9Bw&amp;sa=X&amp;oi=smap&amp;resnum=1&amp;ct=result&amp;cd=1&amp;usg=AFQjCNEo7vyusYvbSY6fpxS5HYzJG_bV4g">Bodyboard en Balcobo</a></div><div><a href="/url?q=http://www.surfgz.com/index.php%3Foption%3Dcom_search%26searchword%3Danos%26searchphrase%3Dexact%26ordering%3Dnewest&amp;ei=lNJySufgJN2ZjAeBsqW9Bw&amp;sa=X&amp;oi=smap&amp;resnum=1&amp;ct=result&amp;cd=2&amp;usg=AFQjCNHpSa9rkzIJkKssoFQPIAJD6-eCNA">Anos</a></div><div><a href="/url?q=http://www.surfgz.com/index.php%3Foption%3Dcom_search%26searchword%3Dauga%26searchphrase%3Dexact%26ordering%3Dnewest&amp;ei=lNJySufgJN2ZjAeBsqW9Bw&amp;sa=X&amp;oi=smap&amp;resnum=1&amp;ct=result&amp;cd=3&amp;usg=AFQjCNE4uxiVhis5BoCTINr2Tl8iKz0hQA">Auga</a></div></td><td style="padding-left:20px"><div>

[Kiko das Leiras]

Vou aproveitar o fío pra deixar info sobre este incidente. Atopei algo similar nos foros oficiais.

Susawx, I'm sorry you are having to go through this, but yes, I think we fixed it. I'm sad to say the only way you will get rid of this one is to go through your site directory by directory.

We found a couple malicious php files, one in particular named wso2.php, which returned our passwords and directory mapping information, and then added links to our page if the site was viewed through google. That allowed the hacker to overwrite a few different files that we found over the course of a few weeks. Here are some starting points to getting rid of it:

1.) Check you administrator/index.php file. Ours had a script that returned our passwords to a specific email address.

2.) Then change all your passwords.

3.) Check your other directories to see if any changes to have been made to permissions. If there has been changes, that will tip you off to where they are overwriting or adding files. You'll probably find something in those directories.

4.) Change the permissions of directories to 755 and all files to 644, no matter what.

5.) For a thorough investigation, take a Joomla install package that matches your version and compare that package file by file to what you have on your server. Extra files that have not been installed by you or components you are using should be discarded.

6.) Take that install package and overwrite your web server files, and this will most likely at least temporarily fix your problem with Google. I also recommend adding a sitemap through Google's webmaster tools so that you can better control when they update the cache of your site.

That's the Joomla side, then there is hosting issues. Check your ftp logs first and that will let you know where the hack is coming from (any i.p address listed that isn't you). Ask your host to blacklist that I.P. address.

Then change your passwords again to be safe. You can also invest around $60 into RSfirewall (which i did) for better security. I installed that and have been happy with it so far.

I know that is exhaustive, but it is definitely an exhausting situation. Hope that helps.

http://forum.joomla.org/viewtopic.php?f=432&t=418523

Parece que me inxectaron algún código malvado

[Kiko das Leiras]

Boas,

Estou analizando moita info na rede e atopei o seguinte nas ferramentas de Google para Webmaster:

Consultas de búsqueda máis habituais

Información sobre as consultas de búsqueda de usuarios que devolveron páxinas do seu sitio

12% jessica nigri
12% cory mccool
9% the young veins myspace
4% robert gibbs is the zodiac killer
2% cory mccool cancer
2% komo 4 weather
2% dawn warrior guide
2% leela naidu bengali actress

Seica a minha web aparece cando fan procuras desta palabras. Por que pode ser isto???

[minhoca]

Supoño que en canto pasen uns dias, google actualizará a información.

Entraronche no web? Como foi?

[Kiko das Leiras]

Supoño que en canto pasen uns dias, google actualizará a información.

Entraronche no web? Como foi?

Pois non o sei. Seica deixei algunha porta aberta... (chronocomments, JXTnews, etc...)

Seguirei informando...

[Medulio]

Supoño que en canto pasen uns dias, google actualizará a información.

Tamén se pode pedir unha actualización "urxente" por medio das ferramentas do Google para webmasters.

Pois non o sei. Seica deixei algunha porta aberta... (chronocomments, JXTnews, etc...)

Seguirei informando...

Bótalle un ollo a isto:
http://www.google.com/safebrowsing/diagnostic?site=www.surfgz.com
http://www.UnmaskParasites.com/security-report/?page=www.surfgz.com
http://www.unmaskparasites.com/web-page-options/?url=http%3A//www.surfgz.com/taboleiro/faq.php
http://www.unmaskparasites.com/web-page-options/?url=http%3A//www.surfgz.com/taboleiro/faq.php%3Frakhi%2520sawant%2520swayamvar

[Medulio]

Pois non o sei. Seica deixei algunha porta aberta... (chronocomments, JXTnews, etc...)

Paseille o Paros Proxy (sen parar moito, tampouco) ao teu web. Ollo coas ligazós para o StatCounter, pois semella poden ser aproveitadas para a execución de Cross-Site Scripting...

[Kiko das Leiras]

Boas Medulio,

Moitas grazas pola túa axuda.

Acabo de borrar o código de Statscounter e vou esperar uns días a ver que pasa....

Tamén borrei o cartafol de TABOLEIRO (foi un intento de crear un foro phpBB3) e quedou no limbo..

[Medulio]

Información extendida:
http://www.diovo.com/2009/03/hidden-iframe-injection-attacks/

Un problema que afecta non só ao Joomla, mais aínda a todo tipo de código XHTML ou PHP.

[Kiko das Leiras]

Boas,

Non sei que pasou pero se escribides "surfgz.com" no Google agora xa non aparece no primeiro lugar. Aparece na terceira posición e artigos pouco importantes...

Que merda!!