Hassan Goodarzi

@jamieedwards
Ok, but seems the problem is from the server, i’m testing a way to make sure that this problem is from the server, i’ll post the result tomorrow.

I have 3 1and1 accounts but one of them only have this problem, maybe the server is infected?

The server ip address is 50.21.189.85, are you on the same server?

@jamieedwards
Sorry, You’re right! ??

I was on WP 3.2.1, i updated to 3.3.1 30 mins ago and seems the problem is gone and the .htaccess file is still not infected.

I think the malicious script was injected to one of the WP core files so when i updated, all files were replaced by new ones and the problem is gone for now.

I got this problem too.
As for a temporary solution:
-delete the infected .htaccess file.
-create another .htaccess file that wordpress uses for permalinks.
-change CHMOD of this file to 444 so no one can edit it even a shitty script!

Since the URL file access is disabled on the most servers you need to edit functions.php file.

find this:
$api_url = "https://maps.googleapis.com/maps/api/geocode/json?".$type."=".$query."&sensor=false&language=".$options['language'];

add below:

$ch = curl_init();
		curl_setopt ($ch, CURLOPT_URL, $api_url);
		curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
		$json_answ = curl_exec($ch);
		curl_close($ch);

remove this:
$json_answ = file_get_contents($api_url);

And it’ll work fine!

hope the developer fix this in the further version.