linux and wget

ccvalixso.ru/in.cgi Malware Hack

Well, after a couple hours of searching I finally found the fix to this.

Situation : GoDaddy Linux shared hosting.  All sites reporting malware and getting the Google Malware warning page.  I went through and searched the url string in the subject here and deleted all the bad code that was causing the redirects (mostly in .htaccess files).  After I was done, I had the following issue.

If I typed the url directly I would go to the site and no Malware warning from Google.  If I did a google search and went to the site that way…BAM.  I would get redirected to the above url and the malware warning would come up.  No fun.

What you need to do.  Connect to GoDaddy shared hosting account via SSH.  You will have to enable SSH on your account for this.  Just search GoDaddy help.  Then delete the mailicious code in the .htacess.  I guess when I removed all the other .htaccesses at the /html level and the /html/sitename.com level I didn’t think to go one directory above the /html to the root of the hosting and search there.  Sure enough that is where the little bastard was.  Screwing up all the sites on the account.

After you delete it make sure you completely clear your browser cache, restart browsers, etc.  You might even need to issue a good dns flush (ipconfig /flushdns) for good measure.  Then go into GoogleWebmaster tools and under Diagnostics->Malware just submit for re-scan.  They will typically re-scan within 48 hours.