Link to home
Start Free TrialLog in
Avatar of Lev Seltzer
Lev SeltzerFlag for Israel

asked on

Google reports "This site may be hacked"

My client www.labinsky.com is listed in google along with the warning "This site may be hacked." I connected the site to google Webmaster Tools, but there is no warning of malware from the control panel. I also connected it to BING webmaster tools, and also no warning of malware (Bing SEARCH never reported a problem with hacking).

The site is a wordpress site, running the latest version of wordpress 3.6.1

Why is google issuing a warning on this site, and how do I get rid of the warning?

Thank you.
ASKER CERTIFIED SOLUTION
Avatar of dec0mpile
dec0mpile
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Avatar of Gary
Gary
Flag of Ireland image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Lev Seltzer

ASKER

I looked at some of the source code and actually could not find the spam! WHat code do you think is hacked?

I disabled ALL the plugins, but securi.net still reports malware.

Interestingly, securi.net says that google does NOT blacklist the site.

What should I do now?
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I open a page (such as http://labinsky.com/financial-planning/goal-setting/, which is listed in sucuri) in MSIE10, click on view source, and then search for "levi" - nothing found. I scan the source file with my eyes and don't see anything.

I know the code is buried somewhere on the site, but I can't figure out where.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
I didn't find anything in the wp_posts table.
Still trying to duplicate the image you received in firebug with the levitra! I can't find it at all.

Will look in header.php shortly....
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
sucuri scanner comes up blank! someone else reported the same problem on the plugin support page.  1-click hardening and wp integrity are all OK.
WordFence reports no problems.
I looked at header.php and found no problems.
header.php
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
This is getting too complicated for me, as I am still not able to see even the malicious code.

Would anyone that has responded recommend sucuri's $89 plan to get clean? Or a competing plan? I will then propose this to my client, rather than spending more and more time on this.

Thank you.
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
SOLUTION
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Thank you all for your help. I am going to recommend sucuri to my client. I think that will end up being cheaper than my continuing to search for the hack.