6

When I search the name of my site on Google, I see site links description which are spammy and not related to my site. Sometimes when I click I get redirect to phishing sites.

Google search results

But I have used many site cleaner tools, and they reported that my site is clean. I have checked my site in Google's webmaster tools for malware, it says no malware detected. Though Google webmaster tools did show about 290 crawl errors, which are unknown links like payday-medcine-money-45451212.html.

My site is in Wordpress, I have looked at themes files and found backdoor.

I don't know what to do, is this malware harmful for my website? How can I get my wordpress site clean?

Improve this question
1
  • 1
    I couldn't help but think, if your giving free themes, and your infected from a backdoored theme, what about the users downloading these themes? You may have lots of infected users depending on how many people visit the site.
    – ComputerLocus
    Commented Mar 26, 2012 at 19:43

1 Answer 1

Reset to default
14

On of the side links points to http://www.moonthemes.com/themes/elegant-best-bussines-portfolio-theme/.

Downloading that file using wget results in:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
    <html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Online LICENSED drugstore ::: Levitra indian price | EXTRA LOW PRICES!
</title>
<meta name='description' lang='en' content='Levitra indian price ::: We sale
   brand and generic drugs. In our pharmacy: US FDA Approved

So unless you put that up there, your server is compromised.

Note that common malware does a number of tricks in order to stay undiscovered. For example it may check the Referer-header, only send the malicious content to a client ip-address onces, check the browser user agent header, etc.

Furthermore it may be hidden in a number of places. For example in the 404 error handler. It might even be possible that the attacker got root permissions and manipulated the webserver software.

You need to get help from someone with experience to identify the vulnerability that was exploited. Then you need to setup the server from scratch.

The server might spread malware to visitors or send email spam. So in order to protect your visitors, third parties from attacks and yourself from legal actions, you should take the server offline.

Improve this answer
1
  • 1
    ^This. Take the server offline, and rebuild it from scratch.
    – scuzzy-delta
    Commented Mar 26, 2012 at 3:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .