WordPress Site Redirects To Porn On iPad

I deloused a system last week that had this particular infection. It seemed to restrict itself to files inside wp-content/ other than the wp-config.php file. It was attracted to many files named index.php as well as several theme and plugin files

I noticed that the infected files were all over 24K in size so I ran the linux find command to find files over that size and piped the resulting files to less, ignoring image files:

find . -type f -name "*.php" \( ! -name "*.png" -a ! -name "*.jpg" -a ! -name "*.mo" \) -size +24k -exec less {} \;

I ran a few variations on the file extension just to be sure.

I also found the files with the name “.. ” which you could easily miss. Again I used find to find them 🙂

find . -type f -name ".. "

I also ran diff checks over themes, plugins and core files to see if there were any changes anywhere else.

I replaced any files I found with clean originals. I also replaced every WordPress core file and re-did the wp-config files.

As for the “.. ” files, note the space at the third character.