帖子内的WordPress主题垃圾邮件链接

Question

I'm creating my own theme in Wordpress. Suddenly in my posts i got random links leading to viagra companies.. can't earse them. I already:

• Checked on plenty malware website scanners - all clear
• Turned off all plugins - links still appear
• Changed theme - links disappear

Moreover i had my own excerpt in functions.php. When i clear it and make default excerpt links disappear but also mine links. When i tried various ways of changing excerpt to display links (for ex. https://wordpress.stackexchange.com/questions/141125/allow-html-in-excerpt ) i always get spam links back.

I'm out of ideas. I also searched my files for some "unwanted" code but haven't found anything. Something is wrong with my theme for sure but i cannot find what.

Will be grateful for any help. Link to my website: www.weterynariagalecki.pl

Answer 1

This happens to Drupal sites a lot, I presume the same holds true for Wordpress.

Have a look at the root file system where your files are hosted. You'll probably see a file in there with 000 file permissions. Pretty good chance it'll be called something like page nn -sql.php or something like similar to that. Could also be that index.php got replaced (again, check permissions).

Here is an exerpt from the Drupal.org page on how to deal with this type of hack. Again, I know it applies to Drupal, but I believe your problem is the same:

Where do attackers exploit Drupal systems?

index.php, or really any code file A common hack is simply to modify the index.php or any code file in the site such as a template file. The methods are various:

A virus on the computer used to administer the site which uses stored credentials in a FTP tool to edit and upload the files (seriously). Arbitrary code execution on the server and loose server file permissions used to edit or overwrite a file. Arbitrary file upload which was used to upload a command shell which was then used to modify the code. Compare all code files to known good copies, either in the revision control system or from drupal.org (the hacked! module can help with that.)

Look for files on the server that are NOT part of your known Drupal codebase, eg modules/system/qseboj.php

Review the files in the "files" directory to ensure they are all appropriate.

It may be helpful to review the combined metadata of owner, group, permissions and timestamps as a fingerprint of the files on the server. If most of the files have one fingerprint and a single other file has a different fingerprint (eg edited about when the attack started) that can help you understand what happened.