Dear blog owner and visitors,

This blog had been infected to serve up Gootloader malware to Google search victims, via a common tactic known as SEO (Search Engine Optimization) poisioning. Your blog was serving up 377 malicious pages. Your blogged served up malware to 0 visitors.

I tried my best to clean up the infection, but I would do the following:

• Upgrade WordPress to the latest version (one way the attackers might have gained access to your server)
• Upgrade all WordPress themes to the latest versions (another way the attackers might have gained access to your server)
• Upgrade all WordPress plugins (another way the attackers might have gained access to your server), and remove any unnecessary plugins.
• Verify all users are valid (in case the attackers left a backup account, to get back in)
• Change all passwords (for WordPress accounts, FTP, SSH, database, etc.) and keys. This is probably how the attackers got in, as they are known to brute force weak passwords
• Run antivirus scans on your server
• Block these IPs (5.8.18.7 and 89.238.176.151), either in your firewall, .htaccess file, or in your /etc/hosts file, as these are the attackers command and control servers, which send malicious commands for your blog to execute
• Check cronjobs (both server and WordPress), aka scheduled tasks. This is a common method that an attacker will use to get back in. If you are not sure, what this is, Google it
• Consider wiping the server completly, as you do not know how deep the infection is. If you decide not to, I recommend installing some security plugins for WordPress, to try and scan for any remaining malicious files. Integrity Checker, WordPress Core Integrity Checker, Sucuri Security,
  and Wordfence Security, all do some level of detection, but not 100% guaranteed
• Go through the process for Google to recrawl your site, to remove the malcious links (to see what malicious pages there were, Go to Google and search site:your_site.com agreement)
• Check subdomains, to see if they were infected as well
• Check file permissions

Gootloader (previously Gootkit) malware has been around since 2014, and is used to initally infect a system, and then sell that access off to other attackers, who then usually deploy additional malware, to include ransomware and banking trojans. By cleaning up your blog, it will make a dent in how they infect victims. PLEASE try to keep it up-to-date and secure, so this does not happen again.

Sincerly,

The Internet Janitor

Below are some links to research/further explaination on Gootloader:

https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/

https://news.sophos.com/en-us/2021/08/12/gootloaders-mothership-controls-malicious-content/

https://www.richinfante.com/2020/04/12/reverse-engineering-dolly-wordpress-malware

https://blog.sucuri.net/2018/12/clever-seo-spam-injection.html

This message

My Philosophy

I have a very simple philosophy underlying my success in real estate. I
simply treat people the way they expect to be treated. Which is why
my clients enjoy professional service based on trust, straight talk, and a
commitment to make each transaction go as smooth and stress-free as
is humanly possible. My attention to details over a career of more than
twenty four years has resulted in an exceptional success rate on closing
transactions on or before the contract date. My service to my clients does
not end at the close of escrow, I regard my clients as “clients for life” and
consequently over 80% of all my business is by referral!

What makes me unique? I believe it is my ability to put myself in my client’s
shoes – to hear their wants and needs, and to negotiate for the best deal
possible. It is my commitment to my clients; above all else, that sets me
apart from other Realtors. Quite simply, I treat my client’s home sale or
purchase as if it were my own. I commit 100% of my effort into the process
when I go to work for my clients.

While traditional real estate agents spend most of their time chasing
down new business, I focus my efforts on delivering personalized, high
quality service to my present and past customers; the kind that builds
relationships and trust – and the kind that results in referrals to friends,
family and business associates. I draw upon many successful years of sales
experience to answer questions, spell out the process and guide my clients
toward their goals. My experience has also prepared me to manage even the
most difficult real estate transaction to a successful closing. My business
philosophy has focused putting my clients first ahead of everything else. I
care about my customers and about doing the job right. Honest, reliable
service is my standard of practice. I know that only by giving exceptional
service will I earn my client’s heartfelt endorsements and referrals.

Sincerely,

Craig Delman

Education: B.A. – Univ. of Arizona
• Life-long resident of the communities I serve. ( Upland, Claremont,
Pomona, La Verne, Chino Hills, Diamond Bar, Rancho Cucamonga, Ontario)
• Received a real estate agent license in June of 1989.
• Realtor with the same company – Tarbell, Realtors – since June of 1989.
• Distinguished member of Tarbell’s Top Producer’s club since 1990.
• Served 2 years as a member of the Ethics and Grievance committee for
the local M.L.S. (nominated by my professional peers for my reputation of
high ethical standards.)
• Received the CRS designation from the Council of Residential Specialists
in June of 2004. (Certified Residential Specialist is the highest
designation awarded to Realtors in the residential sales field. The CRS
designation recognizes professional accomplishments in sales success,
experience, and education. Less than 4 percent of all Realtors hold this
designation.)
• Received a Broker’s license in February of 2006.
• Married for over 28 years with two children.

Welcome to WordPress. This is your first post. Edit or delete it, then start blogging!