How Many Support Interactions Are Needed to Fix a Website Breach?

Avatar
You
  • Posted On 20 Dec, 2019 09:34 CST

On behalf of client: I am having an issue with https://www.windycityparrot.com
wit Google which you can check here –


https://www.loom.com/share/361e04be15bc4f748b45dd996994500f

 

Avatar

Olga Labova
  • [“Cust Service Rep of 2014”]
  • Posts: 72950
  • Posted On 20 Dec, 2019 09:44 CST

Hello Mitch,

Thank you for contacting our Help Desk.

I checked the details on my end and I confirm that I was able to recreate the same issue on my end.

To resolve it, I would highly recommend you to try requesting the re-index of the site from the Googlebot by following these steps:

https://support.google.com/webmasters/answer/6065812?hl=en

As a result, the information should be properly updated and the site should once again show the correct content.

If afterward the results are the same or you need any further assistance and guidance- we are available 24/7, so feel free to contact us again.

Best Regards

Olga Labova
Senior Technical Support

 

Avatar

You
  • Posted On 20 Dec, 2019 09:50 CST

the site is indexed I can see the results when I search – the server is blocking the site from google

If it was not being indexed I could not do this

 

 

 

Avatar

Olga Labova
  • [“Cust Service Rep of 2014”]
  • Posts: 72950
  • Posted On 20 Dec, 2019 10:20 CST

Thank you for the update, Mitch.

In order to investigate further on, can you please confirm when was the last time it was functioning properly and whether there were any recent changes applied on the matter?

For example, if you have applied any important changes in the configuration of the site and its database.

Awaiting your update,

Best Regards

Olga Labova
Senior Technical Support

 

Avatar

You
  • Posted On 20 Dec, 2019 10:26 CST

The drop in traffic occurred sometime around midnight cst wed 12/18

I have found the issue – search console has been blocked until just now and this is what I have found

The site has been hacked and content injected
https://www.screencast.com/t/Y12GPWd0J

it’s important to note windycityparrot.com is 2 sites zencart for eCommerce and WordPress for the blog which is why you see 3 databases but only 1 domain

 

Avatar

You
  • Posted On 20 Dec, 2019 10:27 CST
sorry 3 databases but only 2 domains

 

Avatar

You
  • Posted On 20 Dec, 2019 10:45 CST

please make no changes to the site without talking to me I know about the php (5.4) issue – it’s because of zencart – I don’t want to pay $750 to upgrade all the (62) zencart plugins – especially because I’m about to abandon the site.

Please see if maybe we can roll back windycityparrot.com??

In the meantime, I will accelerate my birdandparrot.info build which is to become windycityparrot.com will try to do that in 2 – 3 days

thank you

 

Avatar

Maria Genova
  • Support Guru
  • Posts: 37600
  • Posted On 20 Dec, 2019 10:57 CST

Hello Mitch,

Thank you for the update!

As per your request, no changes were applied to the website.

Please allow me to explain that as the website was marked by Google it would be best as my colleague mentioned to be re-crawled so this way it will become accessible from Google search.

In regards to restoring the website, this could be done from your cPanel > Backup Tool

https://www.siteground.com/tutorials/cpanel/backup-restore-tool/

If you are not sure how to restore the application, please post a separate ticket from your User Area > Support section > Backup Restore so we could perform it on your behalf.

Also, I ran a malware scan on your account and I am providing you with the results:

Code:
[HEX]reversed_base64_decode [13/06/18] /home/customer/www/geekwindycityparrot.com/public_html/wp-content/cache__old/object/000000/ac0/c96/ac0c964bf5cbd00fa6e037bc83d19cb1.php
[HEX]reversed_base64_decode [13/06/18] /home/customer/www/geekwindycityparrot.com/public_html/wp-content/cache-bk/object/000000/ac0/c96/ac0c964bf5cbd00fa6e037bc83d19cb1.php

Please make sure to clear the provided files as they seem suspicious.

If we could be of any further help, do not hesitate to let us know!

Best Regards
Maria Genova
Technical Support Team

At this point, Siteground asked me to re-crawl the site –  twice now

 

Firstime – Siteground is saying “we don’t know  how to fix this”

 

Avatar

You
  • Posted On 20 Dec, 2019 11:20 CST

I’m talking to my developer – because of the 2 databases zencart and WordPress that have been merged via customization – I’ not sure how to approach the rollback – any suggestions?

for clarity – here’s the issue

 

When you pay $500 a month for web hosting, “I can’t help you” when you know they can is not acceptable.

So I called the 800 number about a half-hour later and spoke to Alexander briefly.

He was worse.

“There is definitely nothing we can do on our end here.

I’m very sorry I wish we could do more but it’s something that you can have to work out with Google

Good luck”

 

Second time – Siteground is saying “we don’t know  how to fix this”

 

Avatar

You
  • Posted On 20 Dec, 2019 12:17 CST
which database was the scan run on?

 

Avatar

You
  • Posted On 20 Dec, 2019 12:26 CST

 

I just ran the SG site scanner which indicated the site was clean and not black listed? how can that be if you found suspected malware and we know is blocking the site?

 

Avatar

You
  • Posted On 20 Dec, 2019 12:27 CST
sorry google is blocking the site

 

Avatar

Maria Genova
  • Support Guru
  • Posts: 37600
  • Posted On 20 Dec, 2019 13:47 CST

I apologize for the delayed reply!

Please allow me to explain that the scan has been made on the cPanel account with username wcparrot. Both of the files are related to your cache folder.

It is just a suggestion to check them and make sure that this account is clean in order to prevent any further issues in the future.

In regards to the website under windycityparrot.com, I was able to resolve the issue by restoring only your .htaccess file and the website is now accessible from Google.

However, I left the previous .htaccess file under the name .htaccess1 and it is under your root directory. I would advise you to contact your website developer so he/she could check the rules inside which could be causing the issue.

If we could be of any further help, do not hesitate to let us know!

Best Regards,
Maria Genova
Technical Support Team

 

Third time – is the charm

 

Avatar

You
  • Posted On 20 Dec, 2019 15:38 CST
I’ll be adding you to my list of future ex-wives Maria:-)

 

Avatar

Bozhana Tringova
  • Support Guru
  • Posts: 16561
  • Posted On 20 Dec, 2019 15:50 CST

You are most welcome Mitch 🙂

I am glad my colleague was able to assist you.

If you need any further assistance don’t hesitate to contact us again.

Best Regards,

Bozhana Tringova
Senior Technical Support

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.