Anyone About ATM To Help Me With Wordpress Problem?

[MurrayMurray is verified member.]

Just noticed a wordpress site of mine has had spam pages created on it

/buy-cialis-daily/ and such

Can't find where the pages are even being created from, no new folders or anything.

Anyone about that's good with wordpress to help remove the pages?

Willing to pay a small fee as thanks

 

[mrt]

I'd be happy to have a look for you, Murray, I've dealt with a lot of this sort of rubbish. It'd be worth having a quick look at your access logs also to look for signs of the malicious activity (assuming logs go back that far). I'll also debrief you with my findings once done!

Feel free to PM me WP+FTP details.

 

[mallymally is verified member.]

check htaccess - I've just had to remove something similar

 

[SkinnerSkinner is verified member.]

I had something like this a while ago, there were some malicious code added to every wordpress editable file, so soon as I corrected one, the code reran.

In the end I deleted the install, started from scratch.

 

[spiderspider]

I had something similar a couple of years back.

Have a read of this:
http://www.pearsonified.com/2010/04/wordpress-pharma-hack.php

 

[MurrayMurray is verified member.]

mrt had a look and fixed it for me

I will let him say what was wrong and how he fixed it if he likes as I don't know the technical explanation

 

[mrt]

In this instance there were a few backdoor shells left behind, and wp-config.php was modified to load some custom code that would pull in whatever malicious pages the attacker wanted on the site.

Not particularly novel really as far as WP abuses go, but it still interests me to see how the techniques used by attackers changes over time.