Wordpress site blacklisted by Google about .htaccess [closed]

Question

my website www.saoyuying.com (the site is in Chinese :)) is included in Google's malware blacklist yesterday. But I didn't find any unusual files on the server. Google's report mentioned that

"Some of the URLs on this site redirect browsers to web pages that install malware. This indicates that the server(s) that host pages for this site may contain altered configuration files (such as Apache's .htaccess file)."

While my .htaccess content is copied below:

# BEGIN WPSuperCache
# END WPSuperCache

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

Is anything harmful here? Or what else should I check? I would really appreciate your help!

Thanks & Regards, Joe

---

[UPDATED]

@Dwayne

Thanks to Dwayne's answer, the actions below have been taken:

I. Installed 3 security plug-ins in wordpress: Exploit Scanner, WP firewall 2, BulletProof Security.

Exploit Scanner scanned the website and found several 'eval' and 'base64_decode' like

eval(function(p,a,c,k,e,r){e=function(c){return(c<a?

I know it just means executing string content. But I was not able to find anything suspicous.

II. Sucuri SiteCheck. The result is here:

Sucuri SiteCheck on saoyuying.com

which says:

Malware found in the URL: http://www.saoyuying.com//404javascript.js

Known javascript malware. Details: http://sucuri.net/malware/malware-entry-mwht291 Location: http://namesti.bee.pl/

But I can't find this '404javascript.js' on the server, nor inside functions.php or index.php.

This js looks like the root cause as the URL 'namesti.bee.pl' is also mentioned in Google's warning.

But how to locate and get rid of it?

Thanks again in advance.

Answer 1

Redirection can happen in many different shapes or forms. Sometimes it is due to an injection into a page or sometimes pages. Usually a snippet of JavaScript or an iFrame is injected into a page which redirects a user when they load a page. The most common form of redirection hack is usually some kind of SQL injection.

I recently encountered a situation where every single PHP file on the site had been injected with some eval base64 code that redirected only users from search engines. So it would only redirect someone to a rogue malware site if they tried accessing your site from Google.

You're site isn't blacklisted permanently, once you sort the infection out then you can request a review and get the report removed. It can be quite involved salvaging a site and then strengthening it but luckily people have created plugins to help out.

There are various attacks that people are using these days to infect Wordpress sites. A simple thing of having too loose permissions on folders like your uploads or even wp-content folder are all it takes.

I've seen a crafty Wordpress hack where they add in about 30 or so blank lines of space into your .htaccess file to give the appearance of everything being alright when they put some redirect code at the bottom of it. This tricked me up a few months ago on a site that got hacked.

This article is rather long and might be an interesting read for you: http://www.esotech.org/resources/cms/wordpress/wordpress-header-javascript-and-iframe-injection-problem-solution-and-analysis - it offers a solution to the hack the author experienced which might not relate to you, but it is a somewhat informative read to help you understand these types of attacks.

Wordpress have a nifty guide up on their codex about steps to take when you think you've been hacked. It doesn't help with everything, but some nice informative steps to remember like changing passwords. Read it here. A quick search of this site will also produce some great resources to read and download when you've been attacked.

It sounds like you've encountered some form of injection attack to me. If you're not comfortable with manual changes to the database and files, you can install this plugin called Exploit Scanner which will scan your database and files for all kinds of malicious attacks like the common iframe injection hack.

A couple of useful plugins I recommend everyone install on their Wordpress sites are: WP Firewall 2 and Bulletproof Security. Bulletproof Security in my opinion is one of those must haves, it protects against CSRF attacks, base64 injection attacks and SQL injection attacks, plus more, it even adds rules to your .htaccess for securing your site further.

WP Firewall 2 inspects web requests and will stop them in their tracks, sending you an email letting you know the details. Sometimes the plugin can get confused, but I recently used this on a site that kept getting defaced by Egyptian hackers modifying pages and injecting HTML somehow and it stopped them.

Answer 2

There is nothing out of the ordinary there, standard WP .htaccess file