redirects visitors that were going to the WordPress site to fake search engines full of ads. To check if you have it (except the obvious- redirection:), try to find a similar chunk of code on your homepage (it should appear just at the end of the html code, behind the closing body tag:
It is caused by a security vulnerability in timthumb.php (also known as tumb.php), which is is a free PHP script that resizes images used by many WP themes developers. Many great WP themes use that script including Elegant Themes, so if you haven’t updated your theme during the last 5 days, your website is probably infected by it! Here is a step by step solution…
How to get rid of this superpuperdomain.com’s Javascirpt Malware:
- Go to your index.php and delete the following code:
- Search for the following files on your server and delete them:
/wp-admin/js/config.php /wp-admin/common.php /wp-admin/udp.php /wp-content/udp.php
Those files are added by hackers and are a part of the phpRemoteView hack, but just in case back up those files (do not open them!!!).
- Update the Timthumb.php
As the creator of this plugin has been informed about this issue a few days ago, the latest corrected versionis already has been created and is available to download here: http://code.google.com/p/timthumb/ so please upload it to your server to replace to old version of Timthumb.php with the new file.
- Make sure that your file permissions are correctly set.According to WP – Security Scan (which I personally use on a few sites), I set the following permissions:
but I also recommend this WordPress article on that
- At the end, you can also block the http://superpuperdomain.com’s IP addresses in your htttaccess file add so additional rules to the httaccess file itself.
- Finaly scane your website for Malware on http://sitecheck.sucuri.net/scanner/
I hope that all of that help you, but let me know if you come across any more problems with that Malware.