To resolve the issue you need to update all your WordPress blogs to the latest version (which at the time of writing is 2.8.6).

Funny but not really …

As soon as I finished with my above post, my domains were hosed again. So now it is happening early morning around 9am CST or so and now about 5:30pm CST or so.

Took me 5 minutes to fix the whole package deal. Got those cleanup scripts running. What I probably do is simply run the scripts every 15 minutes. Whateverrrr…

Maybe the clown has a job. He is not allowed out of his hole on the weekends or after 5:30pm CST. Maybe he hasn’t learn how to schedule cron jobs.

God Help Him/Her.

God Bless
Faith

Exactly the same here – Every domain and sub domain listed on the WHM is being hit whether it is in use or not, xsitepro or WP. One strange thing is that whatever/whoever is doing it does not seem to work on weekends. Saturday and Sunday no problems but then got hit last night and tonight (UK time) and both at the same time – 15.38 Texas time.

One of my domains has several separate wordpress installs in sub directories and none of them are getting touched – only the root domain.

I have to quickly squash this problem or Google will penalize me; folks won’t come back to my sites, etc.

And no. It is not a wordpress ONLY problem. It was caused by a breach. Now that the breach hole is still open and obviously is timed execute every morning at the exact same time, why the heck can’t we kill this bugger?

It MAY have started with a WordPress breach but the problem goes past that. Kiosk, needs to fix this thing for good so this ‘problem’ won’t continue to affect them/us.

It looks like the cron job looks for index.php. if you got index.php, then they put that nasty million-one.net iframe at the bottom. if you do not have index.html, it creates one with that nasty iframe it it.

2 weeks ago i found that my .htaccess file at the root level was compromised. they changed this:
RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ http://www.%{HTTP_HOST}/$1 [R=301,L]

to this:

RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^.*(bot|urp|msn).* [NC]
RewriteRule ^(.*) 2.html [NS,NC,L]

Jerks!

LOL!

God Bless
Faith

My regular websites were attacked as well, so its not a blog only related problem. And I did update one blog to the latest version to see and it got attacked the same as my older version today nov17 2009. sooooo…