Comments on: Pocket SEO Was Hacked :( http://pocketseo.com/black-hat/235 Practical SEO Techniques Fri, 05 Sep 2008 20:55:10 +0000 http://wordpress.org/?v=2.3.3 By: How Long Does It Take For a Google Reinclusion Request? - Pocket SEO http://pocketseo.com/black-hat/235#comment-794 How Long Does It Take For a Google Reinclusion Request? - Pocket SEO Sat, 29 Mar 2008 06:49:37 +0000 http://pocketseo.com/black-hat/235#comment-794 [...] mentioned on the 20th, PocketSEO.com was hacked and penalized by Google. I submitted a reinclusion request the same day that I discovered the [...] […] mentioned on the 20th, PocketSEO.com was hacked and penalized by Google. I submitted a reinclusion request the same day that I discovered the […]

]]> By: Josh http://pocketseo.com/black-hat/235#comment-793 Josh Fri, 28 Mar 2008 05:32:27 +0000 http://pocketseo.com/black-hat/235#comment-793 @Mo Drupal is great. Most of what I do is Drupal. This PocketSEO.com blog was just a WordPress experiment. @Mo

Drupal is great. Most of what I do is Drupal. This PocketSEO.com blog was just a WordPress experiment.

]]> By: Mo http://pocketseo.com/black-hat/235#comment-792 Mo Fri, 28 Mar 2008 04:12:18 +0000 http://pocketseo.com/black-hat/235#comment-792 Just had the same thing happen to me, didn't even get time to rectify the hackery before google vaped the entire site from it's index. I think it's time for a move to drupal. Just had the same thing happen to me, didn’t even get time to rectify the hackery before google vaped the entire site from it’s index.

I think it’s time for a move to drupal.

]]> By: Josh http://pocketseo.com/black-hat/235#comment-776 Josh Mon, 24 Mar 2008 04:45:14 +0000 http://pocketseo.com/black-hat/235#comment-776 <blockquote>It would be really useful if you could explain how to fix it here.</blockquote> Here are the steps to fix it: <ol> <li>Backup all of your files and database</li> <li>It's a good idea to make sure that your backup works by installing it locally</li> <li>I ran a <em>diff</em> on my hacked version of WP vs. a clean version of WP. To run diff, make a directory with two subdirectories. Put your hacked site in one and a clean copy of the same version of WP in the other. Then in the Linux terminal type <strong><tt>diff -rup >output.txt</tt></strong>. The file called "output.txt" will show a list of all changes between your hacked version of WP and a clean copy of WP. If you aren't running Linux, you could either use an <a href="http://www.ubuntu.com/" rel="nofollow">Ubuntu live CD</a> or <a href="http://pocketseo.com/scripts/43" rel="nofollow">install Linux on an external hard drive</a>. Three other methods for running diff are to do it remotely over SSH, to run Mac OS/X, or install Cygwin on Windows.</li> <li>Delete all of your remote WordPress files. You can temporarily put a blank index.html while upgrading so that people can't read your directory.</li> <li>Go into PHPmyAdmin and search your database for keywords like <em>porn</em> and <em>ringtones</em> just to make sure nothing was injected into the database.</li> <li>Upgrade to the latest version of WordPress, including uploading your customized files, including config.php, plugins, etc.</li> <li>Change your WordPress password and FTP password</li> <li>Then be sure to follow <a href="http://pocketseo.com/black-hat/241" rel="nofollow">these steps</a>.</li> </ol> Hope that helps...

It would be really useful if you could explain how to fix it here.

Here are the steps to fix it:

  1. Backup all of your files and database
  2. It’s a good idea to make sure that your backup works by installing it locally
  3. I ran a diff on my hacked version of WP vs. a clean version of WP. To run diff, make a directory with two subdirectories. Put your hacked site in one and a clean copy of the same version of WP in the other. Then in the Linux terminal type diff -rup >output.txt. The file called “output.txt” will show a list of all changes between your hacked version of WP and a clean copy of WP. If you aren’t running Linux, you could either use an Ubuntu live CD or install Linux on an external hard drive. Three other methods for running diff are to do it remotely over SSH, to run Mac OS/X, or install Cygwin on Windows.
  4. Delete all of your remote WordPress files. You can temporarily put a blank index.html while upgrading so that people can’t read your directory.
  5. Go into PHPmyAdmin and search your database for keywords like porn and ringtones just to make sure nothing was injected into the database.
  6. Upgrade to the latest version of WordPress, including uploading your customized files, including config.php, plugins, etc.
  7. Change your WordPress password and FTP password
  8. Then be sure to follow these steps.

Hope that helps…

]]> By: Argentina's Travel http://pocketseo.com/black-hat/235#comment-774 Argentina's Travel Mon, 24 Mar 2008 03:37:15 +0000 http://pocketseo.com/black-hat/235#comment-774 Just happened to us! My bad for not updating. It would be really useful if you could explain how to fix it here. Thanks. Just happened to us! My bad for not updating. It would be really useful if you could explain how to fix it here. Thanks.

]]> By: WordPress, Google Groups, Porn Spam and Malware Distribution - Pocket SEO http://pocketseo.com/black-hat/235#comment-768 WordPress, Google Groups, Porn Spam and Malware Distribution - Pocket SEO Sat, 22 Mar 2008 16:13:00 +0000 http://pocketseo.com/black-hat/235#comment-768 [...] was cleaning out spam comments today, thinking about how this site got hacked a few days ago. Most of the spam comments that bypass Akismet on this site link to pages full of [...] […] was cleaning out spam comments today, thinking about how this site got hacked a few days ago. Most of the spam comments that bypass Akismet on this site link to pages full of […]

]]> By: How To Defend Against Porn Link Injection - Pocket SEO http://pocketseo.com/black-hat/235#comment-763 How To Defend Against Porn Link Injection - Pocket SEO Fri, 21 Mar 2008 13:38:42 +0000 http://pocketseo.com/black-hat/235#comment-763 [...] wrote a post yesterday about how PocketSEO.com was hacked. This site has been heavily penalized because cloaked, hidden porn links were being injected into [...] […] wrote a post yesterday about how PocketSEO.com was hacked. This site has been heavily penalized because cloaked, hidden porn links were being injected into […]

]]> By: Josh http://pocketseo.com/black-hat/235#comment-760 Josh Thu, 20 Mar 2008 12:40:22 +0000 http://pocketseo.com/black-hat/235#comment-760 <blockquote>I just happen to be looking at WassUp plugin at the same time they were making the posts. They only got about three in before I found them and deleted them all.</blockquote> That was lucky. I don't post here often at the moment and I missed it for at least a couple of weeks - maybe longer. I lost my Google rankings. <blockquote>BTW, it is always a good idea to do searches like you you did above every once in a while.</blockquote> I set up Google Alerts for it after it happened. Example: <strong>site:pocketseo.com porn</strong>

I just happen to be looking at WassUp plugin at the same time they were making the posts. They only got about three in before I found them and deleted them all.

That was lucky. I don’t post here often at the moment and I missed it for at least a couple of weeks - maybe longer. I lost my Google rankings.

BTW, it is always a good idea to do searches like you you did above every once in a while.

I set up Google Alerts for it after it happened. Example:
site:pocketseo.com porn

]]> By: stinkie http://pocketseo.com/black-hat/235#comment-759 stinkie Thu, 20 Mar 2008 12:34:10 +0000 http://pocketseo.com/black-hat/235#comment-759 BTW, it is always a good idea to do searches like you you did above every once in a while. BTW, it is always a good idea to do searches like you you did above every once in a while.

]]> By: stinkie http://pocketseo.com/black-hat/235#comment-758 stinkie Thu, 20 Mar 2008 12:32:34 +0000 http://pocketseo.com/black-hat/235#comment-758 Josh, I got hacked a couple months ago by someone inserting posts with cell phone ads. They were making the post dates old so they would be mixed in months back. I just happen to be looking at WassUp plugin at the same time they were making the posts. They only got about three in before I found them and deleted them all. The changed my password and upgraded. It is a never ending battle between hackers/spammers and site owners. Josh, I got hacked a couple months ago by someone inserting posts with cell phone ads. They were making the post dates old so they would be mixed in months back. I just happen to be looking at WassUp plugin at the same time they were making the posts. They only got about three in before I found them and deleted them all. The changed my password and upgraded.

It is a never ending battle between hackers/spammers and site owners.

]]>