Remove malicious Java script

Noscript for firefox is wonderful.

<meta name="generator" content="WordPress 2.2" /> <!-- leave this for stats -->

thats your root problem.

Youre running an insecure version of WP — one that is exploitable using nothing more than the ability to copy and paste code off milw0rm.

And that javascript, might not be the only incursion.

http://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/

Read that, then read some of these:

http://wordpress.org/search/hacked?forums=1

The best and surest thing to do is to shitcan all the files on your server. And start fresh. Save just your wp-config.php, go get a fresh copy of the 2.2 files, and upload those clean files.

THEN: IMMEDIATELY go through the upgrade process.

then, CHANGE ALL YOUR PASSWORDS, including the mysql one.

then go through your database, making sure that there are NO rouge users, and no code inserted into it that shouldnt be..

than be a nice neighbor, and let your host know.

Those are general instructions, your mileage may vary.

I had the same problem and i am not even using wordpress, i had a malicious js injected at the bottom of everypage on the non profit health information provider so i devised this simple script to do all the dirty work for me…

`<%
‘ Remove a string from all asp, htm and html pages on the entire website
‘ Usage:
‘ http://www.ursiteurl.com/fixor.asp?remove=WHAT_EVER_UR_PROBLEM
‘ Credits:
‘ Junaid Ali Qureshi, http://www.doctor-dubai.com, JunaidAliQureshi.blogspot.com

Response.Buffer = False

Const ForReading = 1
Const ForWriting = 2
Set objFSO = CreateObject(“Scripting.FileSystemObject”)

subfolder = server.mappath(“\”)
response.Write(subfolder & “
“)
Set xFolder = objFSO.GetFolder(SubFolder)

fixfilesin(xfolder)

function fixfilesin(fixfiles)
Set xFiles = fixfiles.Files

for each xFile in xFiles

if Right(lcase(xFile.Name), 3) = “asp” or Right(lcase(xFile.Name), 3) = “tml” or Right(lcase(xFile.Name), 3) = “htm” Then

Dim FileName, Find, ReplaceWith, FileContents, dFileContents
Find = request.QueryString(“remove”)
ReplaceWith = “”
FileName = xFile
response.Write(filename & “
“)
‘Read source text file
FileContents = GetFile(FileName)

‘replace all string In the source file
dFileContents = replace(FileContents, Find, ReplaceWith, 1, -1, 1)

‘Compare source And result
if dFileContents <> FileContents Then
‘write result If different
WriteFile FileName, dFileContents
response.Write(FileName & ” contents : **************************************’****************************************'” )
response.Write “Replace done.

“
If Len(ReplaceWith) <> Len(Find) Then ‘Can we count n of replacements?
REsponse.Write( (Len(dFileContents) – Len(FileContents)) / (Len(ReplaceWith)-Len(Find)) ) & ” replacements.”
End If
Else
Response.write “Searched string Not In the source file
“
End If

‘Read text file

end if

next

for each fldr2 in fixfiles.subfolders
fixfilesin(fldr2)
next
End Function

function GetFile(FileName)
If FileName<>”” Then
Dim FS, FileStream
Set FS = CreateObject(“Scripting.FileSystemObject”)
on error resume Next
Set FileStream = FS.OpenTextFile(FileName)
GetFile = FileStream.ReadAll
End If
End Function

‘Write string As a text file.
function WriteFile(FileName, Contents)
Dim OutStream, FS

‘on error resume Next
Set FS = CreateObject(“Scripting.FileSystemObject”)
Set OutStream = FS.OpenTextFile(FileName, 2, True)
OutStream.Write Contents
End Function

%>`