A New WordPress Virus Discovered by DownloadTube Dev. Team

[downloadtube]

Recently, we have accidentally discovered in our blog posts a new dangerous viral activity based on an advertising script that exploits the security leaks of WordPress platform. This type of attack could be also present in the tens of millions of online WordPress blogs. The rest of the article can be found [url removed].

[webcosmo]

If its on advertising script, may be its not WP.

[Bobo99]

what does it do exactly?

[downloadtube]

Unfortunately, we have lost traffic and SERP due to this attack. The virus actions upon WordPress platform by inserting a .PHP file in the root of the installation directory and then it connects to the database. On a successful connection various blog posts are modified with long lists of spam links masked with CSS. (the visitors cannot see them, but the search engine robots index those links). As a consequence, you will have to manually check all of your posts and remove the link after the .PHP file removal. The most simple solution to check the affected posts is to create an xml file of RSS feeds from all of your posts and view them in an RSS reader.

[downloadtube]

As I have already responded to the previous question a .PHP file contains a script that is able to connect to the MySQL database and modify blog posts with spam links masked with CSS. The consequences are very unpleasant: loosing of SERP, and the exclusion of search engine index is also possible.