How it happened I have no idea, but happen it did, as last night I found out that Tokyo Times had been hacked, the only blessing being that it’s now no longer affecting the site’s appearance or usability in any way whatsoever. However, at the same time, it is still altering any resultant searches for the site, making it look like a very dodgy pharmacy indeed — the malevolent code greedily gorging on the Google ranking Tokyo Times has built up over the years and then regurgitating it to the unscrupulous bastards selling said pharmaceuticals.
Needless to say I’m currently doing my best to sort things out, although it’s not easy, so I’d definitely appreciate any advice should someone else have suffered the same (pharma) hack/attack.
But in the meantime, please bear with me whilst I try and sweep away the garbage.
Update: Thankfully, searches appear to be slowly returning to normal, so fingers crossed everything should be fine. And for anybody else who ends up suffering the same unpleasantness, this page will guide you through the necessary steps to get rid of any malicious code.
My Kafkaesque Life says
These people are scum! It takes so long and so much effort to built a blog or site like yours and increase your page rank by writing good posts or posting good photos. That really makes me mad, because it can happen to me one day, too. To anyone, that is. Sorry, I’m not so good with these things, but I’d appreciate if you blog about it when you solve the problem. Hope someone can help you. Good luck.
Lee says
Thanks! And, yes, coudn’t agree more, they are scum.
Fingers crossed I can get it fixed, but I’m frustrated to say the least at the moment…
Dave says
Up to date on your WordPress updates? That’s most likely (as in 99.9% chance) the reason you were hacked…
WordPress is an OK platform, but it’s an exploit-ridden hell of a spaghetti-code piece of software. If you aren’t using the very latest version at all time, you can be sure within days some of these scum will have found your site (it’s extremely easy to look for specific versions, using Google) and “hacked it” (i.e. run some automated tools that install their crap on your server).
Lee says
That’s the annoying thing Dave (well, one of them anyway), I was up to date. Seems this pharma hack can get in regardless of what version you are running…
vijay says
Been there myself. This is why I’ve been screaming for months asking folks to stay off of wordpress. It’s a common side-effect of using wordpress – spam injection.
related tweets which might be useful in future:
http://twitpic.com/1ip4ni
http://twitter.com/vjk2005/status/12902095505
http://twitter.com/vjk2005/status/12899056721
Laura says
I haven’t experienced the pharma hack myself, but I do use the Thesis theme on a couple of blogs I run (not my personal blog, which is at WordPress.com) and I happened to read that Chris Pearson (who developed Thesis) has experienced the same (or a similar) hack. Not sure if you’ve read this, but I hope it helps:
http://www.pearsonified.com/2010/04/wordpress-pharma-hack.php
(Just for clarity, I’m not suggesting that the Thesis theme has anything to do with being vulnerable, but just that I happen to follow Chris’ blog because I have the theme as well and that’s how I came across his post.)
Lee says
Cheers for the link Laura. Funnily enough I’ve just been through the steps Chris listed. Just hope they work now.
Ed says
This is a great link you shared with us, Laura. Thanks. And my reply to vijay above is that WordPress is a wonderful application; you just need to be careful when you host your blog on your own server and take the proper care of the server.
Mann says
Good luck with it!
Laura says
I hope that worked for you – it is such a monumental pain to have to go through everything and isolate every little thing that may have been changed.
If it doesn’t work, you might try contacting your host to see if they can help. Also, this site may offer you additional insight (and good to subscribe to them on Twitter for updates of any hacks circulating): http://www.wpsecuritylock.com/blog/
Lee says
Thanks again Laura. I’ve bookmarked that. Yes, after a practically sleepless night last night, a very fuzzy day at work, and then constant messing about since I’ve been home, it’s not much fun is it?
Definitely not how it should be…
Al says
Are you on godaddy.com? Having the most recent version of WordPress doesn’t usually help. Nor does changing your password. I’ve been hacked about a dozen times in the past few months, always with the most recent version of WordPress. The good thing is that restoration only takes a few minutes. Unfortunately, I have to do it for all four of my blogs.
Check out the steps here if you are on godaddy.com:
http://traveljapanblog.com/ashland/2010/05/malware-hack-on-godaddy-com-wordpress-sites/
Lee says
Thanks for the info Al, but no, I’m not on godaddy.com. Although that said, a few minutes to restore everything would be nice.Perhaps not so much though if it was a regular thing…
Ed says
This is clever, Lee. I’ve heard only bad things about godaddy; stay away from it.
Johan says
Hope this doesn’t mess with your ability to take great pictures. Don’t let the bastards drag you down.
Lee says
Cheers Johan! It is pretty disheartening I have to say, but things seem to be improving so I feel a fair bit better today.
Yasukostyle says
I am so sorry about what happened. Hope it straightens out soon. Good luck. Thank you for great images.
Lee says
Thank you! Things seem to be on the mend., so fingers crossed it should be business as usual. Or at least I hope so.
Tornadoes28 says
Wow, that sucks. How do they attack your page ranking? That’s a new one to me. Hope you can fix it soon.
Lee says
Cheers. Don’t know how they did it, and people with infinitely more knowledge on such things don’t seem to know either….
David LaSpina says
Sorry to hear you got hacked, Lee. I hope you get it all straightened out. I see someone already posted Chris Pearson’s story on it, so I’m afraid I don’t have any advice, but I wish you the best
Lee says
Thanks David. I followed the instructions to remove the malicious code that Chris suggested, and some searches are returning to normal. Hopefully it’s just a matter of time now for Google to visit all my pages and restore them to how they should they be.