Click to See Complete Forum and Search --> : Wordpress blog and g-oogl-e.com?
I have a wordpress blog that has a weird issue. On page load in the status bar there is a looping connect/waiting/transfering for g-oogl-e.com (hyphens intentionally added), while the page tries to load. The images are no longer showing. I haven't touched the code for months and it was working a little while ago.
I presumed it had been hacked so DLed all the code for the site and searched for the offending domain name within the files. Nothing. I thought maybe the server was compromised and a .htaccess is rewriting somewhere? Can't find one if it is!
Anyone seen this before and might know what's causing it?
I would agree that you've probably been hacked. Just searching for "g-oogl-e.com" on Google returns some pretty nasty results so I think that is an indication that that site is no good.
Hackers design this stuff to be hard to find for the average user (or even expert users). You may need to contact your hosting provider to ask for assistance.
At the most extreme you could totally wipe your entire account saving only your content and theme. Then reinstall a fresh copy of WordPress (the latest version). You'll want to go through all your theme files and database backup with a fine-tooth comb before you re-upload them.
Before you do anything though, you should definitely change ALL your passwords associated with your account. Make sure they're as complex as possible and not simple dictionary words. You can use a tool like this (http://strongpasswordgenerator.com/) or this (http://howsecureismypassword.net/) for really secure passwords.
Jarrod1937
01-28-2011, 08:50 AM
Do a base64 encoding of the domain name and then do a search. Its a common way for hacked code to hide itself. Also, view the site source and see where the domain is being called, this can help you determine where it may be in your sites code. You can also look for html code surrounding the domain request, if the domain is sufficiently obscured, sometimes searching for the code that encloses it can yield results.
Though, the best solution is to re-install all core files from the wordpress site and restore any backups you have of your main template files.
It turned to be a .htaccess in all the image upload directories. Permission denied on the attempt to delete so have had to ask my host to delete them.
wp-content/uploads/2009/07/.htaccess
I missed them initially as for some reason Core FTP isn't showing the hidden files, even though it's set to. I SSHed in to double check and sure enough there they are. I've not fixed the blog yet and am hoping that there's not another file that's writing them in there!
I also found in the process another way to access the files in the other shared hosted accounts. My host is so crap it's unbelievable! As the site are not very important it's not worth my time to move everything, but maybe I'll find the time! Anyway just thought I'd update in case anyone else has the issue and googles through.