Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Back in February my work's site was attacked by a pharma hack at the shared hosting end. I managed to find the placed file and the reference to run it in one of our files. I deleted this file, deleted and redownloaded all of the plugins and themes and reinstalled Wordpress. However I could never find the database entries no matter what I have read up on. Searching for known entries or for drug names backwards etc.

On the Google and Bing end I have managed to deny and delete the entries and cache of most if not all of the bad links that the hack managed to instantly SEO to death (why don't these guys work legit and make more money?)

However the one thing that is remaining is external links on the homepage that are invisible except when the site is viewed in google cache or scanned with unmaskparasites.com (and says that the external links are safe even though they're obviously not!).

http://www.UnmaskParasites.com/security-report/?page=kmcharityteam.co.uk

All sorts of website scans say there's nothing wrong with it and I can't find the source of the links in the header or footer or anywhere in the theme. I've searched for the links in the database but no use there either and they change every day so really I'd have to be looking for a generator?

Does anybody have any advice or a solution for removing these links? Thanks!

share|improve this question
1  
Your site is still hacked. eg, see here > webcache.googleusercontent.com/… –  user29671 Jun 3 at 11:02
1  
This might help > codex.wordpress.org/FAQ_My_site_was_hacked –  user29671 Jun 3 at 11:07
    
Thank you for your reply. If you go to kmcharityteam.co.uk/novaldex it says 404 not found. That faq says to do everything that I've already done or to 'start a new fresh site from scratch.' which isn't an option or 'You can attempt to manually locate and remove the malicious code.' which is what I'd like to do but it doesn't provide any help on.. –  Beatchef Jun 3 at 12:50
    
it says 404 now, when I posted it was redirecting to 247drugsshop.com And if you click on the url on the search results, you will see that it still redirects to the spam site. So you are still hacked and it is not only finding the problem but also securing the site for the future. –  user29671 Jun 3 at 13:47
    
go somewhere like here and get professional help hackrepair.com –  user29671 Jun 3 at 13:48
show 1 more comment

1 Answer 1

You said the links on the homepage change every day. That would give us the answer. That means either that the script has a large list of links that it pushes one to the homepage in random or it access some external source for links. If the second is the case, prevent all external http requests that your script is generating (by disabling curl or any similar function) and then try loading the homepage. The link should not appear now. Now look at the logs and find out which script generated an access denied error when you loaded the homepage. This should point you to the direction of the malicious script.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.