Yes, indeed, it’s in the footer.php file, and very hard to remove. I learned I had the file when running a “see your site as google bot sees it” simulation. Meso*elioma.com turned up at the very end of all the links, completely unrelated to the topic of my blog. Then I googled blogname + meso*elioma and found that it was on all my permalinks + pages. Googling gave me the text that was actually being displayed, which pointed to the theme’s footer. Then I went to “view” on the menu, and found “view source.” In View Source, drop down to “Page source”, click it, and a window of all the code opens up. Go to Edit, drop down to “Find in this page,” and type in meso*elioma, that mellifluous word.
It will show up, believe me.
Now the task is rooting it out. Actually, for this exploit running in WP 2.0.4, commenting out all the extra php from the Andreas 04 theme worked briefly, but I went back and checked again, and the SEO killer word was there again.
What I have now done is to eliminate all code from the footer.php file. I also moved the call for it down below the Google Analyticator code in the Main html file in your theme, but that may not make much difference.
Unless somehow this blank file calls a file from a website without my being able to see it, that should work. I will type in the credits that normally go in the footer and put them on my sidebar.
The affected/infected blog is
https://www.formytummy.com/
I don’t know how it got there, or what was compromised to get it there, so what further fixes my blog might need are up in the air.
