Pages

▼

Tuesday, April 07, 2009

Google says I've been hacked--and they're delisting me? Help!

I got the following message today, and I followed all their instructions but I honestly have no idea where these hidden keywords are lurking on my site or how to find and remove--Google's documentation is really confusing and seems to assume I'm some paid fancy webmistress instead of a blogging cartoonist. Any help or suggestions are appreciated--I don't need to be any more obscure than I already am!

By the way, I did check to make sure this wasn't a spam email--I have a webmaster account on Google and it really is from them.

Dear site owner or webmaster of mikhaela.net,

While we were indexing your webpages, we detected that some of your pages were using techniques that are outside our quality guidelines, which can be found here: http://www.google.com/support/webmasters/bin/answer.py?answer=35769&hl=en. This appears to be because your site has been modified by a third party. Typically, the offending party gains access to an insecure directory that has open permissions. Many times, they will upload files or modify existing ones, which then show up as spam in our index.

The following is some example hidden text we found at http://mikhaela.net/:

# # fathers # ub # comunity # mambo # seam # denied # resellers # racial # knight

In order to preserve the quality of our search engine, pages from mikhaela.net are scheduled to be removed temporarily from our search results for at least 30 days.

We would prefer to keep your pages in Google's index. If you wish to be reconsidered, please correct or remove all pages (may not be limited to the examples provided) that are outside our quality guidelines. One potential remedy is to contact your web host technical support for assistance. For more information about security for webmasters, see http://googlewebmastercentral.blogspot.com/2008/04/my-sites-been-hacked-now-what.html. When such changes have been made, please visit https://www.google.com/webmasters/tools/reconsideration?hl=en to learn more and submit your site for reconsideration.

Sincerely, Google Search Quality Team

This sucks and I am royally confused.
at

3 comments:

  1. Brian McFadden11:51 PM

    Have you viewed the source of your main page? Once you open that up, you can search for the suspect keywords and see where they are.

    If they are there, my guess is someone got into your Blogger account and mucked with the template.

    If not, Google's being a dick.

    ReplyDelete
  2. Unknown12:07 AM

    Hi.

    I hate mysteries so I did some digging around on the web. Take a look at this [Yahoo cached] version of your site:

    http://74.6.146.127/search/cache?ei=UTF-8&p=mikhaela+reseller&fr=yfp-t-501&u=www.mikhaela.net/&w=mikhaela+reseller+resellers&d=WOIc-kxISl0K&icp=1&.intl=us

    with firebug or otherwise view the source of that iframe. Zip down to the bottom and inside the <div id="footer"> block you'll see what Google is talking about.

    You've had your site poisoned with some bad PHP, namely adsttnmq1/sdioyslkjs2
    as described here:
    http://www.esuli.it/index.php/2009/03/24/adsttnmq1sdioyslkjs2-attack/

    This search will show you're not alone:
    http://www.google.com/search?query=adsttnmq1

    ReplyDelete
  3. Mikhaela Reid12:52 AM

    thanks guys--but I tried doing that look at the cached site with Firebug and I can't see anything in that div id block! I'll have to keep looking. This is so weird/confusing... I'll keep trying to figure out how to fix.

    ReplyDelete