Joomla! Discussion Forums

Alright guys, I have spent quite a few hours over the last few weeks trying to figure why when you search "site:dynamicearth.net" in google it comes up with almost 700 pages that are all spam pages. These cached pages are all linking to articles that come back as a 404 error and if you check the cached page, it takes you to some other site that talks about perscription drugs. When I first found out about this problem, the main google listing for the site had different pharmaceuticals listed as the title and meta info. The search results for ask and bing all come up fine but I did just notice that if you search yahoo.com for dynamicearth.net, the second listing is for one of the bad pages. We thought we had found the problem when we noticed there were close to 40 bots crawling our phpbb so we delete all of them and we thought that worked because all the search results were right, whether you searched Dynamic Earth or site:dynamicearth.net. Then a few days later I did the site: search and what do you know, 600 pages of the same stuff.

We had some bots get registered on the site and forums when their captchas were cracked but they have all been deleted to the best of my knowledge. We have also added recaptcha to the website registration and the forums registration with hopes this will keep them out.

I have read through the Security Checklist and have done most of the stuff on it.

I followed what Dynamicnet said from this forum topic. The box is secured and runs quite a few websites and they have never had this problem. He is using mod_security on the box. I have updated all extensions and removed all unused extensions and all files and tables belonging to them. All machines have been scanned and there are no viruses on any of them. (One of my buddies helping with this problem thought it was user related until he searched it at his store.) Only the people who are supposed to be above registered, are. I have not changed the passwords to everything yet because I would rather get this taken care of first.

The website did not come back as a malicious site but I setup the webmaster tools through google and scanned the site as a googlebot when this first happened and it was coming back with all the wrong meta info, but this was corrected with deleting the bots from phpbb3.

Here is the jtspost assistant info.




Diagnostic Information
Joomla! Version: Joomla! 1.5.14 Stable [ Wojmamni Ama Naiki ] 30-July-2009 23:00 GMT
configuration.php: Not Writable (Mode: 444 ) | RG_EMULATION: N/A
Architecture/Platform: Linux 2.6.18-92.el5 ( i686) | Web Server: Apache/2.2.10 (Unix) mod_ssl/2.2.10 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_perl/2.0.4 Perl/v5.8.8 ( dynamicearth.net ) | PHP Version: 5.2.6
PHP Requirements: register_globals: Disabled | magic_quotes_gpc: Enabled | safe_mode: Disabled | MySQL Support: Yes | XML Support: Yes | zlib Support: Yes
mbstring Support (1.5): Yes | iconv Support (1.5): Yes | save.session_path: [color=red]Not Writable[color] | Max.Execution Time: 30 seconds | File Uploads: Enabled
MySQL Version: 5.0.81-community ( Localhost via UNIX socket )

Extended Information:
SEF: Disabled (without ReWrite) | FTP Layer: Disabled | htaccess: Not Implemented
PHP/suExec: User and Web Server accounts are not the same. (PHP/suExec probably not installed)
PHP Environment: API: cgi | MySQLi: No | Max. Memory: 32M | Max. Upload Size: 2M | Max. Post Size: 8M | Max. Input Time: 60 | Zend Version: 2.2.0
Disabled Functions: show_source, system, shell_exec, passthru, exec, phpinfo, popen, proc_open, allow_url_fopen
MySQL Client: 5.0.81 ( latin1 )



Any help would be greatly appreciated.


PS I am sure you are going to need more info but this is what I could think of now. Just let me know if there is anymore you may need.

^^? Dont know exactly what that means.

Forgot to list all my plugins/components/modules that I am using.

Com
-Alpharegistration
-Mehdi Coppermine Bridge
-Eventlist
-Eventlist Calender
-Rokbridge
-xMap

Modules
-mod_dimensionmenu
-mod_dphpbb3_last_topics
-mod_eventlistcal15q
-mod_globalnews
-mod_tweets

Plugins
-Contact - JCCReCaptchaCV
-Button - Xmap Link
-LazyBackup 2
-System - AlphaRegistration
-System - JCCReCaptcha

well,

to say the box IS secured and then i have to see that there are frontpage extensions enabled on that server...
that is NOT secure ...

also the zend version used is kinda old.
php settings are standard php settings, but ok.

you dont use .htaccess
search for .htaccess and why it does make sense to have .htaccess enabled.
also suPHP seems not to be installed.

a good way, to keep morons away from your webspace is apache mod_security.

i cant say anything to phpBB .. maybe someone else can do so...

thats what i see on quick check.

ok lets begin for now:

(dont know is this is fixed:



do you have the newest version ? is this "tool" obsolet or does the developer care about ?

also evenlist had some issues in that past.. newest version ? -> 3.8.4 ?
same for the calendar...

Thank FW. I will talk to the owner of the box and see what he says about your first post.

I thought I had the .htaccess file in my joomla folder but I do not see it now. I will look in to that this evening.

Yesterday I went through and updated all of the extensions that I am currently using and deleted all the old extensions along with all their files and tables.


edit - Sorry this is my other account. Just noticed.

I jsut talked to the box owner and he says he does not have mod_security running.

he should think about installing it.. its not that hard to install...

Ya he is tomorrow when we get to the office.

Ok I got the .htaccess & .htpasswd setup but it is not working quite yet. I am getting this error after entering the user and pass.



This is what the AuthUserFile line says. /usr/local/psa/home/vhosts/dynamicearth.net/httpdocs/.htpasswd But my structure is not setup like that. Should I make it http://dynamicearth.net/"whatever folder"/.htpasswd or something similar? Or should it be /"whatever folder"/.htpasswd?

if this is your document root it should be there ... why do you use a .htpasswd ?
error message :i would guess that the server doesnt have the correct vhost and or path variable set.

1) he simply does not find the path to .htaccess or pw
2) or apache mod_rewrite is not configured in the right way...

Alright I got the .htaccess working. Spent most of the morning trying to figure out wtf was going on. My .htaccess is working and my non-www now forwards to www, which has nothing to do with this topic but it took me 2 hours to figure out you have to put RewriteBase / to get a redirect to work.

Anyways the box is locked up tight and is safe and up to date. The guy who owns the box sits next to me in our office and he has quite a few joomla sites that have not had this problem with that same security as mine.

I just deleted 20 spam accounts that had been disabled in Joomla Back end. Figured it couldnt hurt. I am going to go through all the Joomla and phpbb3 users and see if there are any that I may have missed.

I also found that the index.php files in 2 of the 4 joomla templates were at a 555 on permissions. So I am guessing that someone or some bot changed the permissions. I have gone through and changed all the permissions of folders to 755 and files to 644 but I am still worried there is something in there somewhere.

Also there are always 20-30 visitors on the site at all times. We have a total of 259 users and I dont think that many are on at one time, but I could be wrong.

I also changed the password to an auto-generated one through cpanel, so it is now super secure.

Any ideas of where to look for whatever is hitting these pages? Is there any way to add a list of bad bots to the robots.txt file?

Thanks fw,

Jay

Sorry I keep logging in as different people but this is what is saved on my work computer and the other is at home.

Here are the differences in links.

This is an actual article on our site.
http://www.dynamicearth.net/index.php?o ... Itemid=122
And what the bad ones look like.
http://www.dynamicearth.net/index.php?o ... Itemld=332

All the good links have the &id="#" and the bad ones dont.

Also in Webmaster tools --> Links to your site --> Anchor Text there are 51 items and only 16 of them are the good ones.

I did also go through the sql db of users and tested every email from the user list on boyscout.com and came up with another 10 or so users on both website and forums. All of which have been users for a while.

There are 717 cached pages and I am going to see how many are in the morning and see if deleting those users helped.