mikeostrich

You’re welcome. Let us know if that works!

I deleted a few things.

First off, I also deleted the folder of bad links which I found in:

/public_html/[suspicious foldername]

Then I deleted the file plugin.php found here:

/public_html/wp-includes/js/tinymce/plugins/plugin.php

(deleting tinymce will cause more bad than good. It’s part of WordPress in my case)

Note, that plugin.php had 777 permissions when I found it. I first renamed it to plugin.php.bad and made sure my website still worked properly. After inspecting the content of the file, I confirmed that it was suspect, and deleted it.

Finally, I noticed that my .htaccess file ALSO had 777 perms, which it should never have. I changed those perms to 644.

And that’s it. Relatively easy to remove BUT our search traffic is messed up now since those links were indexed. I’m going to keep an eye out for anything weird in the next few days.

Yes, this happened to us.

Ths file was flagged by a malware scan:
/wp-includes/js/tinymce/plugins/plugin.php

As well as a directory full of strange links.

I did Google search and found the following, which describes the issue.

It appears to be a link building exploit, which I noticed in my analytics stats because we were getting hits on keywords that we never wrote.

Now that I’ve deleted the offending folder, I’ll have to see if it’s resolved in the next few days. Right now, we’re getting a lot of weird search traffic because those weird links got indexed.

The main page ads seem relevant on my side, but you might want to try blocking certain ads that you don’t want to see through your adsense account.

Dunkkan, thanks for the info. I’m trying to do something similar, and this code is moving in the right direction for what i’m trying to achieve

Mike

You can try to backup your blog first, and then re-copy the original wp-admin files back to your site.

Alternatively, check the time-stamps on the wp-admin files via your ftp client. The most recent date modified should point you to the file that you last edited. If you know where your mistake is, you can try correcting it and uploading it back.

Again, take a full backup first.

Comment options should be under Settings/Discussion

When you copied your site over to the new host, your file and directory permissions may not have been preserved. Usually, you want:

644 for files
755 for directories.

I’d verify the permissions of your files. Have they changed recently?