corrupted search engine results on MSN and Google ?

[andytc]

Hi

 

I need some help with a search engine issue , I really don't know where to begin solving this, so any help as to how to proceed or deal with this would be a real bonus.

 

PROBLEM

 

 

I recently did a search on MSN to check my placement for a certain product and clicked the view "cached page" result.

 

The page shown contains links to porn and warez sites , at the very top above my Header.

 

Here is the link to MSN search results - look at the first link listed - click view "cached page" and you will see the links in text format

 

http://search.msn.co.uk/results.aspx?q=wil...opter&FORM=QBHP

 

 

I have no clue how are these appearing on my site ?

 

If you click on the main search result link , it shows my page as normal , without the links to warez and porn. But all the cached page links do?

 

 

Also , in my referer logs i have entrys like the following -

 

++++.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

 

I cannot click the link to reveal a site , these appear more than 4 times.

 

We dont have any connection with porn or warez and dont have any banner ads or anything else.

 

Can anyone explain how this could have happened and how i might resolve it ?

 

I contacted my host and got this response -

 

"Sorry, we cannot assist with search engine results. We have received no complaints from other customers nor have our anti-intrusion systems detected any irregularties. However, you may be running outdated software on your site that may be vunerable (such as old e107, phpbb or phpnuke installations). It is your responsibility to ensure that all scripts are up to date. I would suggest trying to find the same page in Google's cache as it is most likely a fault at MSN."

 

I checked google and for some reason the cached pages cannot be found

 

other conflicting advice is -

 

"If your site/host has been compromised, there may be a cloaking mechanism inserted which would add the links either dependent on IP address or by user agent.

 

(A "hack" of this nature is more successful over a longer term than a defacement as it is feeding off your rankings to boost the other sites, so it is best when it remains undiscovered for a while.)

 

Obviously if you have been hacked, you need to take your site offline and rebuild from a known good backup on a new server, probably at a new host. There are several known exploits for osCommerce 2.2 - which precise version are you using?"

 

 

God forbid i have to start all over again ! , think i'd rather jump outta the window !!!

 

I have about a week or so's work left to do on the site , would just changing hosts solve anything or are my Osc files corrupted ?

 

 

any help... any insight .....please :)

 

Osc 2.2

[Guest]

Yes, something is going on, and, it is cloaked. Not a very sophisticated cloak, just based on user agent. If you switch your user browser user agent so as to pretend to be Googlebot or MSN Bot, you will see these links on your pages, just the same as they appear in the cache. But regular browsers see the clean page. BTW it affects every one of your pages.

 

So, how does this happen? Someone with access to your server config or htaccess folder has caused this to happen. It could be that you, or your host, has been compromised. Or your host is in on it.

 

UA switcher here:

 

https://addons.mozilla.org/extensions/moreinfo.php?id=59

[Guest]

And BTW you don't have to rebuild the site. just clean it up if you can, and change the passwords. If you can't fix it without server admin access, then your host will have to fix it.

[andytc]

Or your host is in on it.

 

 

Thank you so much for the help , I downloaded the user agent switcher and the links still show to me all the time. It is on every single cached page, except one.

 

The only clue i have is that in the last few days i installed a "site map" page using a contrib from here , it is the only page that does not contain the links ? I'm trying to work out why that page is clean and the older pages are not. There is nothing wrong with the contrib , it's just interesting that the new page is clean and i'm wondering what that tells me ?

 

 

My host , mmmmmm , they have taken some complaints recently about sex pills ad's appearing in the back end C-panel , not good for paid hosting and a premium account. They deny all knowledge of being compromised , but they have done a fair bit of shifting around recently with a lot of down time.

 

If i changed hosts would this problem follow along ? Is it a fairly easy to task to move my installation of Osc to another host ?

 

also , i'm not sure what my .htaccess files should contain , there seems to be a few of them in various directories.

 

Thanks for you help , any further info you can give me would be very much appreciated. :thumbsup:

[Guest]

they have taken some complaints recently about sex pills ad's appearing

i would drop them like a bad habit!

 

any honest host would NOT serve their loyal customers garbage like that! i wouldn't even give them a chance to explain...

 

it's extremely easy to change hosts as all osc files are configurable via catalog or admin/config.php and folder names, etc.

[andytc]

i would drop them like a bad habit!

 

any honest host would NOT serve their loyal customers garbage like that! i wouldn't even give them a chance to explain...

 

 

Thanks eww , I'm in the process of finding another host right now. I made a complaint on their "customer service" forum , i wasn't rude , just stated the facts ..... and they banned me for one month !! , no contact , nothing , i'm now even more convinced it's their problem.

 

 

Right now i'm looking for any info on migrating Osc and the database over to a new host.

 

Thanks :thumbsup:

[Guest]

I made a complaint on their "customer service" forum , i wasn't rude , just stated the facts ..... and they banned me for one month !!

are you paying (for their hosting)?? :o if so, how do they justify a ban???? but i guess, even for a free user: accept constructive criticism! it helps make your services better (on their part)

 

that definately seems to solidify the culprit if you ask me :)