Youre welcome … Glad it’s sorted 🙂
I’m getting the same hack on my site just today. The “http://i.nuseek.com/images/template/Large-Square/0012_female_student.jpg” image appears on the homepage.php that I use for the static page. Homepage.php is just a copy of page.php from the mandigo theme. The only difference is I added a line to a display random images. If I remove this line, then the image disappears. This is the line I added:
<?php include "http://domain.com/images/random/random_image.php"; ?>
I checked random_images.php thoroughly and there is nothing wrong with it, it’s a fairly basic code:
<?php
$total = "8";
$file_type = ".jpg";
$image_folder = "/images/random";
$start = "1";
$random = mt_rand($start, $total);
$image_name = $random . $file_type;
echo "<img src=\"$image_folder/$image_name\" alt=\"$image_name\" />";
?>
I upgraded to wordpress 2.6 and it still doesn’t help. I removed the random_images.php line for now, but would like to know how to fix this.
Please advice.
840473
Hi Bebopblues
I had this problem just today & using some of the advice of whooami as well as some thinking outside the square, found that problem with my site & fixed it.
My “rogue code” was inserted into the footer.php & on first look you would never have noticed it as all it had was:
<? include(“layout.lt”); ?>
Which seemed part of the theme coding. But then I opened the layout.lt file & found that it was this file that was calling up the image & the other stuff. So I took this line out & all is fine.
Yours may not be the same, but look for any code in your site that doesn’t seem familiar. Also look through the files inside your chosen theme in wp-content/themes. You may find an odd looking file.
If you send us your site URL we can at least find which page you should look at..
Hope that helps!
Thanks colio.
I searched all the files to find any strange codes but not finding it. I just removed the random_images.php for now as I can’t figure out how to undo the hack. I might have install wordpress from scratch and restore backups just to get rid of it.
Just curious, how is this hack executed? Is it exploiting a flaw in wordpress? And has this flaw been fixed in the latest wordpress? Also, how would one report this to the developers?
