Tell me more ×
WordPress Answers is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm trying to fix a site which has been injected with external spam. After inspection I found out that the external content (so far just html advertising different kinds of drugs, no scripts) was in the static pages created by w3 total cache.

How can I find out what part is responsible for this? The obvious answer would be the w3 total cache plugin itself, but the pgcache is actually writeable by any part of wordpress so it might be any other plugin or even the WP core.

I have searched the web for this problem but found nothing directly relevant.

Of course wordpress is updated to the latest version available (3.0.2) as is every installed plugin. It does not depend on the theme as it happened with two different ones.

share|improve this question

3 Answers

up vote 2 down vote accepted

It is prolly injected in your files. Look at the plugin files, search for eval or base64.

share|improve this answer
I found malicious code hidden in a couple of plugins and even inside wp-includes/js/tinymce – Matteo Riva Dec 8 '10 at 15:46
up vote 0 down vote

I doubt the W3 cache is targeted. More likely is that spam is not injected in page for admin users, so you don't see anything in non-cached version, but regular page does contain spam and so it gets cached.

As usual there are plenty of info around on cleaning up hacked sites, starting with FAQ My site was hacked in Codex. But really it's very case by case.

Clean reinstall and restore from known good backup is best bet, if not possible you are up for a lot of manual work (or hiring someone who specializes in such issues).

share|improve this answer
But if I disable the page caching, the same page shows no spam to an unregistered user. That's why I assumed that spam is injected only in the cached version. – Matteo Riva Dec 8 '10 at 10:02
@kemp another possibility is that spam is only injected for search engines by user agent. Google webmaster dashboard has function to request page as their bot sees it. Alternatively I think there are Firefox plugins around that allow to fake user agent. – Rarst♦ Dec 8 '10 at 11:08
I know it is case by case by my sites seem to have injections in them about every week. wordpress file monitor usually gives some warning about the added files and sometimes not e.g. changes made in footer.php are not reported but after I remove the injected code the change is reported... anyway... handy plugin to install. – edelwater Dec 8 '10 at 23:01
up vote 0 down vote

I found a Script to find base64 in files. Until I found this, I was going in circles. Once you clean up your files, be sure to set permissions, read-only for all of them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.