Pharma hack — my way to recover from it

  • Resolved motomixon

    (@motomixon)


    11 years, 8 months ago

    If you are so unlucky as to have been waylaid by the Pharma Hack, I hope the following will help you.
    First, see here possible-pharma-hack and here spam-hacks for some background. The hack I am speaking about you discover by searching for your website on Google, and then, within the listing are various references to viagra and whatever else. By viewing your website itself, you will never know you have been affected.

    Second, I assume your webhost has phpMyadmin and file editing (always backup first) and you know how to use these tools.

    Thirdly, the hack has various components, you need to remove them all.

    Here goes:
    a) In your wp_options there is a row where option_name = “_descriptionhtml1” Delete that line.
    b) The file functions.php in theme 2010 is tainted. Go to the bottom of the file, after the function twentyten_posted_in is where the bad code starts. It starts with

    if (!function_exists("b_call")) {
function b_call() {
	if (!ob_get_level()) ob_start("b_goes");
}

    and goes the end of the file. Delete this code (remember, I said, do backups, then test your site).

    I wish I knew how the attacked occurred, but the popular hosting service with daddy in it is on the web has a reputation for lack internal security, so I moved my website. Your call….

Viewing 2 replies - 1 through 2 (of 2 total)
Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘Pharma hack — my way to recover from it’ is closed to new replies.