Serendipity Forums

Hello all,
I have just discovered a very curious thing that has been happening to my blog, and I am not sure if it is some type of malware. Basically, I noticed some odd google searches were showing my blog. For example, searching for 'homemade personalized halloween bags, cowgirl' in google turns up my blog (blog.palsoftwaredesigns.com). My blog has nothing to do with halloween.
What I find very curious is that in google the short description lists a bunch of halloween terms, but there are none of those terms in the source code of the post which google is displaying in search. If you click on the cached version of the page, you get a totally different page than the actual page on my site. Is this malware? I cannot find anything wrong on my site itself, just on google. It seems odd, because it is actually directing more traffic to my site (which doesn't really seem logical for a malware program to do).

Just so clarify what I am talking about, try this:
1. In google type 'homemade personalized halloween bags, cowgirl'
2. Find my blog (PAL blog) and look at the description
3. Click on the cached version
4. Then click on the actual link to see the version that is on my server

Any help would be greatly appreciated! Thanks!

Jose

Hi!

Google cache lists your old page running with serendpity 1.5.2 - your new one runs on 1.5.4. I suppose you had malware in your template before upgrading, and got rid of it by upgrading to 1.5.4. Google should soon catch up on your blog to properly reflect the uninfected content.

HTH,
Garvin

garvinhicking wrote:I suppose you had malware in your template before upgrading, and got rid of it by upgrading to 1.5.4.

Just out of curiousity (feel free to answer very briefly if it's complicated): How does one get malware in a template?!?

YL

Yes. I updgraded to the new version in order fix the problem and it seems to have worked. The odd thing is that even before I upgraded, the code on my site itself did not have the offending content that the cached version on google had. I have since changed my serendipity login info and my ftp password. We will see if that works.

I would also like to know how one gets malware like this. Is it preventable? Thanks.

jose

Hi!

yellowled wrote:

garvinhicking wrote:I suppose you had malware in your template before upgrading, and got rid of it by upgrading to 1.5.4.

Just out of curiousity (feel free to answer very briefly if it's complicated): How does one get malware in a template?!?

Usually scripts spy out FTP info or use holes to simply inject their JS code in anything where they can find a "<div>" or "</body>" tag or so.

Regards,
Garvin