Spam insert in our page

viakunst
(@viakunst)

14 years, 2 months ago

Hello,

I have a problem with our wordpress script at our website.

In some way we get some spam inserts at our postings.

You can not see this when you open the page only when you look to the HTML of the page you will see the info about this.

They start with <!– blabla-start –><span style=”height: 0pt;width: 2pt;position: absolute;overflow: auto;”>
As well -> <!– bubbleGUM-end –><!– O.ooooo-start –>

Rest of the message then will be bad things. After we delete these things they are comming back just some time after we deleted it.

So does anyone know how to get this stopped.

Our website is http://www.viakunst.nl

Greetigs

Sebas

Viewing 8 replies - 1 through 8 (of 8 total)

Mark Ratledge
(@songdogtech)

14 years, 2 months ago

See FAQ: My site was hacked « WordPress Codex and how-to-completely-clean-your-hacked-wordpress-installation and WordPress Foums › hacked.

mujeee
(@mujeee)

14 years ago

Hello,

I have same problem as viakunst.

I tried:

– upgrade WordPress to 2.9.2 – nothing change
– check database – nothing change
– check files on FTP – nothing change

And finally:
– reinstall WordPress (delete all files and upload new instalation) – nothing change

I’m really desperate 🙁

Rev. Voodoo
(@rvoodoo)

14 years ago

@songdogtech’s reply applies to you. Read those links. Do everything mentioned

mujeee
(@mujeee)

14 years ago

RVoodoo: I tried ALL of them. Nothing wrong in database, clean WordPress install and there are spam in source code in website. I really don’t know what is wrong.

mujeee
(@mujeee)

14 years ago

This problem is also in Joomla and OSCommerce:

http://www.google.cz/search?hl=cs&client=firefox-a&hs=7km&rls=org.mozilla%3Acs%3Aofficial&q=%3Cfont+style%3D%22position%3A+absolute%3Boverflow%3A+hidden%3Bheight%3A+0%3Bwidth%3A+0%22%3E&lr=&aq=f&aqi=&aql=&oq=&gs_rfai=

dugbug
(@dugbug)

14 years ago

MujEEE,

When you say check database, what did you do?

Did you do a search of your wp SQL dbase for the string “blahbl” or whatever is unique about the malware text.

All the matches will be listed and you can manually replace the SQL items with correct values.

I had this problem and they had tried to screw with wp-options/siteurl. I wonder if the technique used on me was similar to your situation.

Rev. Voodoo
(@rvoodoo)

14 years ago

http://www.rvoodoo.com/2010/02/the-dreaded-base64-wordpress-hack-and-other-hacks-too/

you can check out what I went through when I got hacked. If you keep cleaning files, and keep having things come back. Theres a decent chance you have a hidden file on your system injecting stuff into all/some of your php files.

mujeee
(@mujeee)

14 years ago

Sorry for all. I used two databases and checked only first. But first database is unused. I corrected all data in second database and everything is ok.

Problem is solved.