Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

The site is Videos-de-musica.com it is a simple wordpress blog with music videos. Somehow the subdomain stats.videos-de-musica.com filled up with spam, I remember setting the domain for pwiki stats, but then uninstalled it and I don't remember what happened to it.

This is an example spam page stats.videos-de-musica.com/aal-0exe.htm

When you search PRINTABLE SUPERMAN EMBLEM BATMAN on Google that is the first result, and when you access it you are redirected to a "Google has found malicious software may be installed onto your computer if you proceed" scam site.

I have tried disabling all the plugins with no change.

Does anybody know what happened and how to remove this?

I am downloading all the site directory to search for any clues.

Thanks.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Hi @JavierRey:

You probably downloaded a theme or plugin that added a "backdoor." Otto has a good post on the subject:

share|improve this answer
    
Wow, that was really useful, I searched for base64 and from there found a directory with TXT files with the spam content. I will now try to find the source and delete from there. BTW, it was in the wpau-backup folder, for automated backups. I don't know if that was the script responsable for the backdoor or I was just the folder used. Thanks! –  JavierRey Apr 24 '11 at 1:57
    
@JavierRey - Glad I was able to help! –  MikeSchinkel Apr 25 '11 at 6:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.