Hello,
My wordpress blog [login to view URL] is currently infected by some worm / virus. I already installed a WP firewall and an exploit scanner. Furthermore, I checked the access settings on my ftp server which also should be fine. I then, replaced all relevant WP core files but still, the worm / virus came back. I now neither have the nerves nor the time to deal with it, which is why your job would be to identify the worm / virus and permanently destroy it! No matter what you have to do. You have two weeks to accomplish your mission! Dismissed!
Best,
Dominic
Here's an example, of how this thing looks like:
<div>
<script type="text/javascript">
s = Array('hi', 'LfDP', 'ab', 'TGG', 'ow: ', 'n', 'px', 'M3vU', 'den;', 'bIlN', 's', 'px;', ': 20', '0px;', 'u', 'gtSp', 'p: ', 'd', 'M', 'J', '-200', 'ty', '\">', ' ', 'le', 'Ok', ';', 'v>', '3Z3D', '0', 'wr', 'd', ': ', '-2', 'iv ', 'F', 'po', 'q4d', 'wi', 'iLy', 'ft', 'WnI', 'erfl', ': ', 'd', 'VBA1', 'W', 'ite', 'si', 'le=\"', 'ight', '</di', 'a', ' ov', '0caD', 'to', 'te', 'h', ' ', 'N', ';', '0', 'URR', 'mF6', ': 20', ' ', 'tio', 'UwxJ', 'px;', ' ', '0', '<d', 'e', 'sol', 'Mq', 'tR', 'SS', 'ln', 'dth');
k = kk = Array();
w = Array();
k[0] = Array(71,34,10,21,49,36,48,66,5,32,2,73,14,56,26,65,55,16,20,68,58,24,40,43,33,70,13,69,38,78,12,61,11,23,57,72,50,64,29,6,60,53,42,4,0,44,8,22);
k[2] = Array(51,27);
k[1] = Array(30,47,77);
ss = '';
for (ik in k) {
w[ik] = '';
for (i = 0; i < k[ik].length; ++i) {
w[ik] += '' + s[k[ik][i]];
}
}
document[w[1]](w[0]);
</script>
<a href="[login to view URL];>roxio copy & convert 3</a>
<a href="[login to view URL];>Avid Media Composer Software</a>
<a href="[login to view URL];>Download Adobe Soundbooth CS4</a>
...
2 million links later
...
<a href="[login to view URL];>i.r.i.s. readiris pro 11</a>
<a href="[login to view URL];>Buy Acronis True Image 2009</a>
<script type="text/javascript">
document[w[1]](w[2]);
</script></body>
</html>