pharma hack

The plugin files that this exploit write look like this:

[Code moderated as per the Forum Rules. Please use the pastebin]

This file appeared as “ext-akismet.php”

Carefully follow this guide:

https://codex.www.ads-software.com/FAQ_My_site_was_hacked

When you’re done, implement some (if not all) of the recommended security measures:

https://codex.www.ads-software.com/Hardening_WordPress

Short of deleting everything, I have already followed both of those articles and it’s no help.

This has to be a hole in wordpress itself, i’m assuming poor security in one of the core files.

https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottodestruct.com/blog/2009/hacked-wordpress-backdoors/

The back door could be anywhere on the server.

Yes, I’ve followed those as well – no dice.

Have you changed your FTP password yet? One of the theories is that malware is intercepting or has intercepted the FTP password (which is sent in the clear), providing easy access to your server.

I also tried all above tricks and still the spammers return. I do have some nice variations of the akismet pharma hacks if you want to research this exploit (currently 5 versions). just message me lifesizedATgmail if you want to get the files. I scanned my machine for malware and found a few pieces. removed it. Cleaned my computer completely. Then i changed my FTP username/pwd and woke up the following morning with spam firing on all cyclinders still. I have to give the spammers credit. Whatever they are doing is pretty smart stuff and i also was guilty of sloppy wp updating for a while.

Have you tried changing your .htaccess file? See this post:

“Top 5 WordPress Security Tips You Most Likely Don’t Follow”:

https://www.wptavern.com/top-5-wordpress-security-tips-you-most-likely-dont-follow

NOTE: See my post at bottom of that page.

Note 2: Your link “https://www.pearsonified.com/2010/04/wordpress-pharma-hack.php” is already 404.

I posted about this pharma hack here:

https://blog.sucuri.net/2010/07/understanding-and-cleaning-the-pharma-hack-on-wordpress.html

It seems that you forgot to remove the backdoor being used to give the attackers access to your system. I as said in the post, searching only for eval(base64_decode is not enough, since they are hiding it now too. If you do not remove it, they will re-infect your site every so often..

thanks,

Hello all, where are you hosting? Search the forum for “Pharma” and “Dreamhost” – there are at least two Dreamhost clients reporting the same clean/re-infection problem (me being one of them).