How I fixed my hacked wordpress blog

What to do if your Wordpress Blog is hacked

1. To find out if the website has been compromised use the below mentioned site to see if the site has any malware or trojans. This is a free scanner. It will list all the malicious js found on your website which was what happened in my case.
1. http://sitecheck.sucuri.net/scanner/
2. You can use this site to beautify infected javascripts found on your website.
1. http://jsbeautifier.org/
3. User grep to find all the files which have the suspicious code. The ">" writes the output to the file mentioned in the command
1. grep -r -l '<String to find>' *.* . > output.txt
2. Also try the command: grep -r -l '<String to find>' *
3. search for the string “eval”, “base64_decode”
4. Change the eval() function to the alert() function. This will print the javascript instead of executing it. Now open the page in your browser and the malicious code will be printed instead of being executed.
5. Check the database with the following sql script:
1. SELECT * FROM wp_posts WHERE post_content LIKE '%<iframe%'
   UNION
   SELECT * FROM wp_posts WHERE post_content LIKE '%<noscript%'
   UNION
   SELECT * FROM wp_posts WHERE post_content LIKE '%display:%'
6. Write a shell script to remove the malicious script. Use the below script for inline editing
1. grep -lr -e '<String to find>' * | xargs sed -i '/<String to find>/d'o

We were using an older version of wordpress which had vulnerabilities against XSS attacks. To prevent further hacking we moved to the latest version of Wordpress.

Helpful weblogs:

• http://sitecheck.sucuri.net/scanner/
• http://jsbeautifier.org/
• http://blog.sucuri.net/2010/02/removing-malware-from-a-wordpress-blog-case-study.html
• http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
• http://ottopress.com/2009/hacked-wordpress-backdoors/
• http://codex.wordpress.org/FAQ_My_site_was_hacked
• http://ocaoimh.ie/2008/06/08/did-your-wordpress-site-get-hacked/