Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Over the past couple of weeks, we've noticed that the search results from Google for some of our drupal-powered sites are having their page titles hijacked somehow. An example would be:

free streaming porn - [Actual page title]

There are other variations of the porn prefix, that's one of the more tame ones. I looked in the databases for each of these sites and the titles haven't actually been changed or anything along those lines. When you click on the result to visit the page everything looks normal (sans porn stuff). Would anyone be able to point me in the right direction as to what the cause of this is?

share|improve this question
    
Links to some example queries and URLs would be helpful. –  ceejayoz Nov 29 '11 at 22:50
    
Here's results from the latest site that's been affected: bit.ly/vMw0ia –  rfoote Nov 29 '11 at 22:56
add comment

migrated from stackoverflow.com Nov 29 '11 at 22:50

This question came from our site for professional and enthusiast programmers.

3 Answers

up vote 7 down vote accepted

First of all, this isn't happening on bing or any other search engines. Also, when I view the pages, like you said, the bad titles don't appear.

Therefore, what I think is happening is that your site has became infected with a virus that causes google to see a different version of your page than what other people see, with the bad titles. This is easy to do, as when google browses webpages, it uses a special header and certain ip addresses, and therefor anyone can tell when google is visiting a site. You can test this by using google's webmaster tools "fetch as googlebot" feature: if the title of the page is different, than that's what is happening.

If that is the case, I would get someone to remove that virus from your drupal installation. Once that virus is gone, then google will re-index your pages, and the search results will be back to normal.

UPDATE (much later): Matt Cutts, the head of Google's webspam team, just posted a blog post that explains the basics of this problem, and where you can go to get more information and/or receive help.

share|improve this answer
    
You were right - as soon as I started to go in and check the drupal installation I saw a bunch of malicious code that was inserted onto some of the core files. Thanks for the help - now the task is to go and figure out how this got in here in the first place! –  rfoote Nov 29 '11 at 23:36
    
@rfoote glad to help. Could you accept this answer though (click the green check mark underneath the up and down arrows), so that way people know you solved the problem. Thanks :) –  Christofian Nov 29 '11 at 23:41
2  
For reference, it looks like it was airschk that was messing with these sites of ours. Now the trick is to find out where our vulnerability lies so this doesn't happen again! –  rfoote Nov 30 '11 at 0:05
add comment

Are you sure that the virus is not on your end?

Have you tried other PCs and perhaps even other networks (in case your proxy is infected)?

share|improve this answer
    
Yes, our clients that we run these sites for have been catching these before we do, and we're able to independently verify it on our end. I also checked the internal link reports via google webmaster tools and its reporting back a bunch of similar things. For example, one of the entries: –  rfoote Nov 29 '11 at 22:50
1  
+1 May not be the answer in this case, but this actually is a symptom of some variants of spyware/scumware so this answer represents valid concerns. –  danlefree Nov 30 '11 at 6:26
add comment

Problem: Drupal website page titles has "live streaming porn" text in prefix in only google search results

Solution: Visit drupal base directory for these 2 files index.php and install.php hackers have written a function GLOBAL $wehaveitagain; remove the complete function. Login to google webmaster tools and submit the URL's which you want to remove only from cache; revisit google webmaster once you see success message for submitted links and resubmit the URL's. Check if your sitemap.xml and robots.txt are manipulated by hackers if so create fresh XML and .txt files and upload it to your server.

Once google re-indexes pages your site will be normal.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.