Google SERP displaying spam like TITLE result but this not seen on the page

[DotCar]

Thanks for pointing that out.  I actually wasn't aware how much spam there was from when the site was on Blogger.

With that said I'm cleaning the spam comments up.  Ther are no alerts in GWT and as I mentioned before I've done a security audit through the servers as well as the other sites on the same account and I dont see any newly added or edited files.

With that said though I don't understand where the Google Cache got the information it's showing for the rating microformat and for the spammy Xanex items which is what really is troubling me.

[EGOL]

Just looking from the Google SERPs.  Might not be safe clicking through to this site.

Make this query in google and you will see Xanax in the snippet of the HomePage .... so probably appears in the code.

site:petitefashionista.com Xanax

[DotCar]

This post is deleted!

[EGOL]

You are the one asking the question here, so how would you know value if you saw it?

[DotCar]

If you would like to continually bump your post count like you do on nearly every post feel free to continuing adding comments.  Everyone in this community is well aware that you race to every new thread to get some comment in.  Sometimes you have very helpful comments, sometimes you dont.

-- Jen Lopez edited

[evolvingSEO]

Hi

I only have a minute, but think I can help get you started.

I have seen almost this exact issue before. It ended up being a line of malicious code in the .htaccess file. I would definitely check that file.

Please look in there for any suspicious code and let us know, thanks!

-Dan

[dohertyjf]

Hey Dot Car -

So sorry this has happened to your wife's site. I didn't click through because of it being compromised, but here are my thoughts and a bunch of resources for you:

1. Put up a Temporarily Unavailable page. If you're on Wordpress, use a plugin like this: http://wordpress.org/extend/plugins/maintenance-mode/

2. Change all FTP, database, and other passwords. If you don't know how to do this, you should contact your host to get them to help you (most have 24hr help).

3. Follow these steps from Google (I don't think you have to worry about the Open Redirects) - http://support.google.com/webmasters/bin/answer.py?hl=en&answer=163634

4. Here's a really good list of things to check for Wordpress: http://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/

5. And an older one, but still good: http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/

Unfortunately, the hard thing about a hacked site is that they could have done a multitude of things. I suggest starting with the .htaccess file to make sure it was not hacked, then you'll have to dig deeper into the database. Have you been backing up your database frequently? I hope so. It will make restoring the site a lot easier (aka if you have the backup from two weeks ago, it would be better to lose a couple of weeks of content than to have a hacked site).

Otherwise, if the .htaccess file is not your issue, you'll have to clean the database, looking for things like<iframe%, <noscript%,="" or="" display%="" that="" may="" be="" in="" your="" wp-posts="" database="" table.<="" p=""></iframe%,>

I hope this helps.

John

[dohertyjf]

Hey now guys, let's be civil here. EGOL has helped out a lot of people here, and we are all doing our best with what we are given.

There's no reason to attack someone else.

Thanks.

[DotCar]

Hi John,

Your help here was right on.  For people that stumble across this in the future for me the hack indeed was being called with malicious code in the .htaccess file that was referencing additional code that was tucked away in the php.ini file, the /wp-includes/user.php, and another file that they placed in the /wp-includes/ folder.

I've now rectified the issue which I'm very happy about and if it wasn't for my weekly regular backups I will say this issue would have required much more work. Either way I'm very pleased that this was spotted less than 24 hours from the time the hack took place or there perhaps might have been "traffic effecting" results.

Also, while Google is showing that the site might have been compormised I still have no alerts in GWT and no apparent drop in CTR from Google.

The hacker came from the IP 59.115.0.40 and later returned on 59.115.6.243  out of Taiwan.

-Ryan

[jennita]

Hi, I've edited your response as we ask that all members follow our Community Etiquette in their questions and responses. If you have an issue with another member please contact us at help[at]seomoz.org and we help.

On another note, I know for a fact that EGOL's goal is to help other community members and is not interested in points. There may be other members who are, but he is not one of them. It's always better to assume the best in people, rather than the worst.

[DotCar]

Hi Jennifer - your edits are always appreciated and I completely understand the objective and goals when running community.

With that said I think your statement of "I know for fact" is a little over the top.  I think you could easily say something like "in my opinion" but stating that this is a fact is little certain and being that you are one of the leaders within the community I would not expect you to throw lots of "f_acts_" around especially when judging one's goals/intention/motives.

A fact is something that is true about a subject and can be tested or proven.
          Look for clues such as: " 56% of...., or "The patient experienced..."

An opinion is what someone thinks about that subject.
          Look for clues such as:"I believe...", "It's obvious...", or "They should..."

(I hope that comes out right but in general even if you know someone IRL I would feel that you would NOT know for fact what and individual' true intentions and motives are.  I would say it feels a lot more like an opinion.)

[jennita]

Thank you, I understand the difference between a fact and an opinion. I don't state facts lightly, which should explain how much I trust it to be true.

[DotCar]

It's now been 60 hours since the intrusion.  The intrusion was full cleaned up less than 26 hours it originally occurred and I finally got a notice in GWT which I responded to.

I think the lesson here is even if GWT isn't reporting it, keep checking back as they might be days behind in notifying you in GWT.  Once an alert is then posted to GWT you can then respond accordingly to get the "compromised" notice removed from the SERPs.

[EricaMcGillivray]

I'd add on a make sure your WordPress & all plug-ins are up-to-date. I had a problem with this and it was due to a security flaw in an old version of WP.