krkhan

That is in fact the reason I’m including wp_blog_header.php.

Thanks, that did the trick.

@jjm0109: I replied to the comment too but anyways you need SSH access for using the script.

And I don’t believe this had anything to do with passwords being weak. My password was a random string of digits, mixed case characters and symbols (something like: 34faewSWASA_B).

On my site, _every_ PHP file in existence regardless of its location (inside or outside WP directory) was infected. It seems pretty certain now that GoDaddy’s severs were breached. Too bad they won’t ever accept that.

because it’s not just wordpress being hacked at godaddy

Indeed, as I also found infected PHP files in a directory entirely different than WordPress’.

Interestingly, my site is hosted on GoDaddy as well. @minda40, what about you?

I have fixed my blog using a tiny BASH script which deleted the first line from all PHP files containing the dirty code.

Active plugins:

• Akismet
• All in One SEO Pack
• Configurable Tag Cloud
• Content-negotiation
• FeedBurner FeedSmith
• Google XML Sitemaps
• Limited Category Lists Widget
• MoveComments
• No Revisions
• Ozh’ Better Feed
• Subscribe To Comments
• TweetMeme Retweet Button
• Twitter for WordPress
• WP-Stats
• WP-Syntax

Even the theme files have the garbled PHP code. Will have to write a script to clean all PHP files ?? .

The ninoplas crap is present on all pages on my website too. I believe a plugin has triggered it. Will post the list once I clean my installation.

Fixed by adding the following to the fim_photos.php file:

header("HTTP/1.1 200 OK");
header("Status:200 OK");

MichaelH, thanks for the reply. But the fourth option from the bottom is for the Simple Tagging plugin, whereas I’m using the Simple Tags one. The Simple Tagging importer cannot import tags from the latter.