Since the spam keeps coming back there's most likely a file or code hidden somewhere inside your site folders I dealt with a virus not long ago that left an index.php file in every images folder on the site. The code was in that file.

You may need to look outside the WordPress files for the code that recreates the spam links. Check every single folder in your site's hierarchy. You shouldn't have to keep removing the links every few days.

Originally Posted by vangogh

Since the spam keeps coming back there's most likely a file or code hidden somewhere inside your site folders I dealt with a virus not long ago that left an index.php file in every images folder on the site. The code was in that file.

You may need to look outside the WordPress files for the code that recreates the spam links. Check every single folder in your site's hierarchy. You shouldn't have to keep removing the links every few days.

There is a rhythm to the spam. I have figured out that it appears every 3 days like clockwork.

There was some there on Sunday. I removed it. Because it was "due" today, I checked at about 5:00 pm. and it was not there.

I checked again at 7:15 and it was there.

I will pass along your comments to my designer. She mentioned that she wonders if shutting down the footer would help.

Since you reinstalled the theme from clean files I doubt the problem is anywhere in the theme itself. You may still need to reinstall it at some point, though.

More likely the problem is somewhere else within your site or on the server. Check files and folders outside the theme. Check all of WordPress (you could do a fresh install of WordPress) and check things outside of WordPress.

Right now we are experimenting.

Fortunately, Wordpress allows a person to return to his/her old design with the simple press of a button. With that in mind, my designer told me to return to my old design (the new design is on Thesis theme).

It's been 3 days and the spam thus far has not returned to my footer.

I'm going to give it another full week. If it does not return, I can rule out Wordpress and put the blame on the Thesis theme.....at least that's my thought.

Good strategy, trying to isolate the problem. Do make sure that you're using the most current version of Wordpress, and check for updates on the theme.

tim

I am not sure a designer could harm website ranking on search engines but its a bad SEO definitely...

Chris,

With all due respect, the danger of responding to a thread without reading it is that your response ultimately will not relate to the thread and will not compute. Your response has nothing to do with the topic.

Originally Posted by serandfae

Good strategy, trying to isolate the problem. Do make sure that you're using the most current version of Wordpress, and check for updates on the theme.

tim

Thanks. It appears at this point that Thesis Theme is the problem and not Wordpress.

No further spam has appeared now that I am back using my old version of the blog.

What I'll need to do is have my designer dump the Thesis theme but keep my newer design.

This has been quite a trial, believe me.

Lynn

Strange that the problem would be the theme. I have a hard time believing that's the problem alone given how many people use Thesis. It's possible there's a hole in Thesis that the spammer is exploiting, but I still can't see how the theme itself would be causing the problem, unless it wasn't downloaded from the author's site.

Originally Posted by vangogh

Strange that the problem would be the theme. I have a hard time believing that's the problem alone given how many people use Thesis. It's possible there's a hole in Thesis that the spammer is exploiting, but I still can't see how the theme itself would be causing the problem, unless it wasn't downloaded from the author's site.

Not another ounce of spam since I switched back to my old theme. I will say this.

Thesis theme still exists even though I've switched back. And I'm using the same Wordpress.

The only difference is that the footer information reads differently. It includes information from the original blog as opposed to the new blog.

This is indeed an odd case. But if I were to switch back to my old theme, I'm pretty sure the spam would come back.

It can be a real nightmare to track down the source of hacking attacks. I always recommend that clients change their passwords to something that combines upper and lowercase letters, numbers, and special character (punctuation) if the host allows, and to do this both for FTP access and site access.

Also, use SFTP whenever possible (it's encrypted) rather than FTP if your host supports it.

I recently cleaned up a hack-mare on a client site that turned out to be an ftp attack.

Check your blog files against a clean installation to find suspicious scripts, and be aware that plugins could contain malicious code.

Finally, make sure your files have appropriate permissions set. If you're on a *nix host, files should be owner-writable only, not everyone-writable.

There appears to be a rash of attacks lately, so don't feel bad about being targeted, even if you don't have a high profile site. It can happen to almost anybody!

Believe it or not, SAGA PART II....the nightmare movie that refuses to end.

The hacker or bad spam bot/virus, stopped attacking my footer and it started in on my header instead.

So, VanG was right. It apparently was not the design because the design was totally removed (Thesis Theme) and only Wordpress was left.

After the person started attacking my header, I contacted my Host and told them to remove my site from the air.

Presently it is off line with an "under construction" sign. Not sure when I'll go back up again but I want to start from scratch.

Lennie

Did you upgrade to WordPress 2.8.5 by any chance? It was a fix for spammers injecting links into your WordPress theme. Upgrading and rebuilding from scratch might be the answer.

Have you changed every password associated with your site? WordPress admin, FTP, hosting control panel, database login. You have to make sure to change everything. Also is your computer possibly infected. Someone could have access to your computer and be capturing login info even after you changed it.

Another possibility is the attacker left a backdoor on the server. Have you done through every directory, including those outside the public_html or htdocs directory?

Yes i agree with mate why you are not sending request to Google for that. May your site will come again.

Originally Posted by vangogh

Did you upgrade to WordPress 2.8.5 by any chance? It was a fix for spammers injecting links into your WordPress theme. Upgrading and rebuilding from scratch might be the answer.

Have you changed every password associated with your site? WordPress admin, FTP, hosting control panel, database login. You have to make sure to change everything. Also is your computer possibly infected. Someone could have access to your computer and be capturing login info even after you changed it.

Another possibility is the attacker left a backdoor on the server. Have you done through every directory, including those outside the public_html or htdocs directory?

I was so frustrated that for now I've just stopped dealing with it. The "under construction" sign was put up at my request by Bluehost.

I'm going to take my computer in to a computer tech to see if he can find anything amiss. And at some point I'll have someone look for the hidden code that my web designer was unable to find. If that does not work, I'll have to lose all my hundreds of articles and literally start from scratch.

This is almost unbelievable.

And yes, I upgraded Wordpress. I changed the design several times. Changed my password almost every day. Yet, the spam returned at will.

All the other things you suggested, I did not do because my computer knowledge is very limited.

It sounds suspiciously like an "inside job". Especially after mentioning "bluehost".

I would bet that it is some other "client" on the server that is exploiting some server weakness and can "attack" other accounts on the same server.

Backup your wordpress database and move hosts. The odds are that the hacking goes away at the same time!

Moving hosts might not be a bad idea. The attack could certainly be coming from another site on the server. Why not try a clean install on a new host with a new clean theme and see if that helps.

Thanks, guys!

Today I got an email from someone who asked me why I was sending her emails leading to spam websites.

I looked at the "sent mail" section of my AOL account and noticed that my closed Wordpress blog had somehow sent this woman strange email.

I called Bluehost and asked them how (since an Under Construction sign was up) was someone still sitting around in my blog doing whatever he felt like doing.

The young man with whom I spoke looked at my "Permissions" and told me that the "door" was wide open.

Strange. A couple of weeks ago someone from Bluehost told me that he had secured my permissions.

From his end, the young man fixed my permissions and walked me through upgrading Wordpress again. I now have the absolute most recent version of Wordpress. He told me that security holes are now patched.

I am going to take your advice and get up out of Bluehost. I've been told it's not that simple because some work needs to be done to the blog for it to work with another host.

The young man also disabled some of my plugins. He was the most helpful one from Bluehost. At least he tried.

Are you all allowed to give suggestions of decent hosting sites?

Lynn

Interesting. I suppose your permissions could have been secure a few weeks ago, but have been reopened by a whole somewhere else on the server. This is sounding like the issue is somewhere on the server itself and keeps infecting your site.

I've been told it's not that simple because some work needs to be done to the blog for it to work with another host.

As long as the next host has PHP/MySQL there shouldn't need to be special work done to move the site. Now having said that your site could be harder or easier to move depending on what's there. Here's the process.

Open a new hosting account
Rebuild the site on the new account
Change nameservers with your registrar
Once you know the new site is the one being served, cancel the old account.

As far as a recommended hosting provider, I've been using LiquidWeb for a virtual private server and am very happy with them. I think their shared hosting is a little more expensive than some ($15/month), but I would think it's good given my experience with them.

I've heard good things about HostGator from friends, but have never used them myself.

Thanks, VanG!

My Firewall protection software that I installed caught him in the act and sent me his IP address. He is located in Germany and if you put his IP address into a search engine, you'll see that his IP address is used to attack many, many blogs/websites:

WordPress Firewall has detected and blocked a potential attack!

Web Page: www.hicktownpress.com/wp-content/plugins/fgallery/fim_rss.php?album=-1+union+select+1,0x6875616B,3,4,5,6,7%23
Warning: URL may contain dangerous content! Offending IP: 188.72.213.44 [ Get IP location ] Offending Parameter: album = -1 union select 1,0x6875616B,3,4,5,6,7#
This may be a "SQL Injection Attack."

I went into my server (still with Bluehost at the moment until I move) and blocked his IP address. I received about 4 notices last night so he was actively trying to break in again.