Strange titles showing in WMT?

[KeriMorgret]

Ouch, it sounds like you might have been hacked. Did you have any other GWT notices? Have you tried crawling your site as Googlebot (again through GWT)? I'd first make sure that your site is cleaned up, then go on to worry about the other issues (which may clear up once you get any hacking out of the way).

If you can share your URL, we're happy to take a look to see what we can figure out too.

[ocelot]

Hi Keri

No other notices or messages, but looking at some of the search queries there are some weird entries such as

calcium carbonate
acheter

etc...

Any ideas on how to resolve this and clean this up?

The address of the site is http://bit.ly/aqva2C

How would I set up recrawling the site again?

[KeriMorgret]

This is a bit beyond my skills, but I've asked another associate to step in. If you do a Google search with site:yourdomain.com you'll see a bunch of altered titles.

[ocelot]

Hi Keri

Thanks

Yes I have just noticed that!

I have been doing some research and have come across this article http://www.pearsonified.com/2010/04/wordpress-pharma-hack.php

which seems to be what has happened

What I am trying to work out first is how I back up my db in phpmyadmin.

And when all traces are removed as per the article in the above link - how do I get Google seeing my site properly again ?  Any ideas Keri - do I email them or put it in a recrawl?

[KeriMorgret]

You'll want to fix everything first, then possibly ask for a reconsideration request. I've asked for an associate with more experience in this topic to contribute some help over the next day or so as well.

[ocelot]

In phpmyadmin in the wp_options table

Are these rogue entries?

dashboard_widget_options and then under option value it displays a:4:{s:25:"dashboard_recent_comments";a:1:{s:5:"it...

welcomeinn_admin_options  and again under option value it displays

a:35:{i:0;a:3:{s:4:"name";s:7:"General";s:4:"type"...

[ocelot]

Great Thanks

Just an update I have cleared all plugins on the site, and removed all the dodgy looking entries in wp_options in the db, but one still keeps coming back even after I delete it?

How can I get rid of this?

option_id             option_name                option_value

10853               rewrite_rules a:84:{s:47:"category/(.+?)/feed/(feed|rdf|rss|rss2...

[SEOKeith]

Your site probably has a bot running on it creating those pages, being controlled from another location online.

Do you have shell access to your server?

If you have a backup you are better off cutting your losses and restoring from your last backup.

[randfish]

This can't help a ton, but my blog was hacked a while back and I got a good recommendation to move hosting to WPEngine. It's a bit pricey, but the sites I've set up there have never had a problem; their spam fighting software and assistance from team members is exceptionally good.

Also heard good things about http://www.websitedefender.com/ from some WP folks.

[ocelot]

Hi All

Thanks for all your insight and advice - it surprising the length some people go to in black hat practices to try and spoof the algorithm and try to boost their own sites by hitching a ride on your hard work!

Anyway after a long night and help from these guys sucuri.net who manage to blast through the malware and offer insight and advice resulting in the problem on the site going.

How long will it take Google to recrawl the site because as of 23:02 UK time the malware is still showing in the SERP