When I started managing my friends' website, I had found a folder in it with a bunch of garbage HTML files with names such as: free-nasscamd-server-31day, gorilla-quentin-trollip-pdf, etc...  Assuming someone had hacked those files in there, I had deleted that folder and all those HTML files in it, and checked everywhere else to make sure there wasn't anything else lingering.Two months later, I am still finding in my access logs there are garbage URLs still trying to be accessed somehow, although they return 404 errors now since the pages don't exist.And when I go into Google and type site:{url}, it displays a bunch of garbage URLs as well, such as: {url}/pitchet-program-samsung-wave2/, {url}/rogue-pirates-of-the-caribbean-themes-nokia-x3torrent/, etc...How do I prevent the attempted access to those URLs?How do I remove those garbage URLs from Google?
How do I prevent access to SPAM URLs and remove them from Google's index?
google search;security;google index;404;hacking
Robots.txtIf you have hundreds to thousands of URLS then the easiest method would be to use robots.txt to inform Google that these URLS should not be indexed. This will also trigger Google to review the URLS already listed and hopefully remove them in time. It should be noted that URL removals can take weeks to months depending on volume and how often Google checks back to your site.Webmaster ToolsIf you only have a few dozen urls then the quickest and easiest method when dealing with low-volume url remove is without a doubt using Google's webmaster tools request url removal tool, again please note that this is a mere request and things can take a while to kick in.Hack PreventionYou should also investigate how those files got their in the first place, deleting the files is a great start but understanding how they got in is the most important factor to help prevent this issue arising again. Your friends web host may be able to comment on several security issues, most issues are SQL exploits, out of date plugins and content management systems, weak shared hosting security, weak use of passwords, brute-forcible login systems (ones that don't ban after X attempts). You can also keep an eye out for potential security problems by regularly visiting an Web Apps Exploit Database.