Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
My server's been hacked EMERGENCY

We've usually host our clients site, but we aren't hosting this one. The website itself (weddle-funeral.com) works just fine. if you load google and search for weddle funeral stayton oregon - and click that link, the site links to a scammy pill site.

I went through the site and there were some php files in the wordpress plugins that got quarantined by my antivirus.

I removed ALL non essential files, and uploaded fresh versions of all the plugins, but it's STILL redirecting from google.

I tried logging in to the cpanel (on a virtual private server), and the cpanel flashed a red warning screen

The site's security certificate is not trusted! You attempted to reach XXXXX.com, but the server presented a certificate issued by an entity that is not trusted by your computer's operating system. This may mean that the server has generated its own security credentials, which Google Chrome cannot rely on for identity information, or an attacker may be trying to intercept your communications. You should not proceed, especially if you have never seen this warning before for this site.

(Keep in mind, that's for the HOSTING accounts CPanel)

Is there something in the SERVER probably that's causing the redirect?

EDIT: .htaccess file contents

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress
share|improve this question

migrated from stackoverflow.com Sep 21 '12 at 21:00

This question came from our site for professional and enthusiast programmers.

marked as duplicate by freiheit, Iain Sep 21 '12 at 21:08

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
Did you check for changes to the .htaccess file? I wouldn't worry about the security warning as most shared hosts use self-signed SSL certs which cause this. –  j08691 Sep 21 '12 at 20:38
1  
The .htaccess file seems to be just the standard wordpress .htaccess - added as a note to the question above –  Alex Demchak Sep 21 '12 at 20:40
    
When you said "I removed ALL non essential files, and uploaded fresh versions of all the plugins" does that include your theme(s) too? –  j08691 Sep 21 '12 at 20:43
    
Yes - All the extra themes (twentyeleven/ten) have been removed, and the necessary files have been reuploaded from a fresh version –  Alex Demchak Sep 21 '12 at 20:46
    
and a fresh 'reinstallation' of the newest WordPress –  Alex Demchak Sep 21 '12 at 20:48
add comment

1 Answer

up vote 2 down vote accepted

This isn't a ton of insight, but this looks like a variation of the Wordpress Pharma Hack, which provides different content to the googlebot. In this case, the malicious code on your site seems to be detecting google as a referrer, and providing alternate content to the visitor. Basically, your site is compromised, and you'll need to sanitize it (I'm not an expert in that, but I imagine it would involve reinstalling core & plugins from source, and picking through the DB with a fine-toothed comb).

If your Cpanel cert is bad, then that would be a possible vulnerability to compromise your hosting account.

share|improve this answer
    
Not just reinstalling... deleting and reinstalling. The files for this stuff can be separate scripts that can be used to access the host ("remote admin" / "file manager" scripts etc) and even reattach the bad stuff to WP proper. –  cHao Sep 21 '12 at 20:56
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.