Hit by new pharma hack?
-
So I was hit by the infamous pharma/viagra hack. The injected content is showing up under the header tag on serveral pages. My site is http://www.sugarmesweetbakers.com
I’ve done a week’s worth of research and followed advice from several websites but have yet to resolve the issue. I’d really rather not wipe, hoping I can locate and remove the malware code but have had zero luck thus far. What I’ve done:
-Searched for the base64 jibberish
-Ran the queries to clean the wp_options table mentioned here (http://www.pearsonified.com/2010/04/wordpress-pharma-hack.php)
-Searched for rogue .php files mentioned on several fix sitesThe only thing I’ve found is a rogue index.php file in my wp-content/uploads folder which had very little code in it. I deleted it and even restricted access to the uploads folder so nothing more can be uploaded.
Still the viagra malware lives on. If anyone can take a look at this? I’m at the end of my whits, and after all this research genuinely curious where this rogue code is sitting. Thanks
The topic ‘Hit by new pharma hack?’ is closed to new replies.