The site is Videos-de-musica.com it is a simple wordpress blog with music videos. Somehow the subdomain stats.videos-de-musica.com filled up with spam, I remember setting the domain for pwiki stats, but then uninstalled it and I don't remember what happened to it.

This is an example spam page stats.videos-de-musica.com/aal-0exe.htm

When you search PRINTABLE SUPERMAN EMBLEM BATMAN on Google that is the first result, and when you access it you are redirected to a "Google has found malicious software may be installed onto your computer if you proceed" scam site.

I have tried disabling all the plugins with no change.

Does anybody know what happened and how to remove this?

I am downloading all the site directory to search for any clues.



You probably downloaded a theme or plugin that added a "backdoor." Otto has a good post on the subject:

  • Wow, that was really useful, I searched for base64 and from there found a directory with TXT files with the spam content. I will now try to find the source and delete from there. BTW, it was in the wpau-backup folder, for automated backups. I don't know if that was the script responsable for the backdoor or I was just the folder used. Thanks! – vierja Apr 24 '11 at 1:57
  • @JavierRey - Glad I was able to help! – MikeSchinkel Apr 25 '11 at 6:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.