Solved – WordPress blog infected with Text-enahance

After a client complained of “text-enhance” links all over his blog, I found tons of forum posts instructing users to remove a browser plugin that causes the links to appear on a local machine (on any website).

This is the solution in 99% of situations, but his site was actually infected from within. The solution was very simple though.

It ended up just being some javascript at the bottom of the posts. It can be removed manually, or with a search & replace tool if you’re dealing with a large blog with hundreds or thousands of entries. This particular client had 26 instances of the code.

I’m not sure whether the code was inserted by a malicious program on his computer, or if the site was hacked into some other way, but I can tell you for sure that it happened through the admin, and not by FTP or some other means.

Hope this helps someone…