GuysNation_Rob

That would be great! It’s GuysNation.com

I think I took care of it. I replaced all the core WordPress files after changing all my passwords and I had installed WordPress Firewall.

I keep getting emails saying that WordPress Firewall blocked an attack on wp-comments-post.php

anyone have thoughts on that aspect of it?

I’ll contact my ISP about the possible injection to see what they can do, but I host four other sites, none of which have much traffic at all (less than 20 total hits per day), and none of them have the iframe redirects… though none of them use WordPress.

Very familiar with the FAQ_My_site_was_hacked entry at www.ads-software.com
– stayed calm
– scanned my local, it’s fine
– changed my passwords and secret keys
– have backups
– read the articles
– checked my .htaccess
– upgraded to the latest version of everything

I’m not certain that I’ve successfully removed all of the malicious code from the files because I can’t find out which files the mal-code is in. I looked through all the instances of “iframe” and I didn’t see any spots where it looked like that’s what was causing the redirect.

Do a search in PhpMyAdmin for the phrases “iframe” and the URL’s used in the iframes

not sure what you mean about PhpMyAdmin, but i downloaded the entire site via ftp to a new location on my machine, then used Windows’ search on the entire directory (and subfolders) for “iframe” inside the file. It came up with about 25 files, and I went through each of them one by one, looking for the phrase “iframe” and i looked over what the code was saying and I couldn’t determine which one was causing the redirects. In fairness, I’m not a professional developer, and I wasn’t able to fully follow all the references which used arrays and such. I will admit that I was looking for a piece of code which was basically just the exact HTML reference, maybe with a variable or two thrown in.