[Nottingham] A Google Webmaster Scam?

[Andy Smith]

Hi Martin,

On Wed, Dec 19, 2012 at 05:45:47PM +0000, Martin wrote:
> So how long has that been flashing up?!

Quick things I usually try when trying to track down one of these
things is to look at the modification time and change time (do "stat
filename") of the files concerned and then try to match that up with
a suspicious POST request from the access logs of the site.

That normally manages to narrow it down to the plugin or app which
has been subverted.

Cheers,
Andy

-- 
http://bitfolk.com/ -- No-nonsense VPS hosting

> I'd be interested to hear any (even two word) reviews of their sofas…
Provides seating.         — Andy Davidson