WordPress 2.9.2 Infected with SEO worm, blog.theyoungrens.com, I need some advice on getting it fixed.

Question

I have been trying to get rid of an infection in this (blog.theyoungrens.com) for a few weeks and am at my wits end, I have scoured the DB, and as many source files as possible, to no avail.

I have replaced the theme from fresh files, and the blog is fixed for a short amount of time, but inevitably gets re-infected. FTP passwords have all been changed and not stored, and I'm accessing the site from a non-infected computer.

I have found one or two blog articles about similar SEO worms, but none of them shed light on my specific situation.

Any advice for removing the worm will be GREATLY appreciated.

Answer 1

Here's a list of steps I recommend for anyone facing an infected WP site:

1. Back up your entire site (plug-ins, theme, database, uploads) to your local machine.
2. Delete everything from the server -database, WordPress, all of it.
3. Create a new, blank database
4. Install a fresh copy of WordPress from wordpress.org
5. Check your uploads folder to make sure there aren't any malicious files hiding there (make sure you recognize everything.
6. Re-upload your uploads file.
7. Re-install your plug-ins and theme from clean copies (straight from the WordPress repository works best). If they're no longer available, have a developer clean the PHP code before uploading from a back-up.
8. Walk through the backup of your database to make sure there's no malicious code hiding there, then restore your database after it's clear.

The easiest thing to do is to hire a developer to manually clean your site. There might be a malicious file hiding in your wp-content folder, or there could be a bad entry in your database. Just updating WordPress or re-installing your theme won't fix those.

To find a developer, post a new job on jobs.wordpress.net. Be sure to describe your problem and offer examples of what kind of malicious SEO you're seeing. The more detailed you can be, the easier it will be to hunt down and kill the worm.

Answer 2

If the problem is that you are getting re-infect, you need to try securing your wrodprss after using the same steps you did above.

clean it and seal it :)

a good post with different easy to do stuff to secure wordpress - yet tricky is this http://migh.info/2010/05/securing-your-wordpress-blog/

hope that helps

Good luck securing your blog, hope last time u face this