Links got hijacked, any solution?

[cilembu]

OK, just a heads up report,
I cannot fix the injected links due to its embedded to the post tooo many to fix one by one, however I found the source of the problem, so hopefully it wont happen again in the future.

For some reason the hacker manage to upload a php file, named sql.php, it might be injecting the post database or altering my post when I clicked publish. The codes there are secured codes, so I cannot read it and dont have time to encode it . So I just deleted the file.

For those who are interested in the file, I am sorry, in the brink of myself, I hit the delete button, I should have save it for reference.

Thanks for all the help mates!!

cilembu Reviewed by cilembu on 12th Jan 2011. Links got hijacked, any solution? So, from reports from my users, now I realized that some of my links got hijacked, it redirects to some other files on some filehosts. I am using the autoclickable script I found on KWWH for making the links. I have been trying to look for the cause, and I even fresh installing my wordpress script, disable plugins, but it seemed useless. Any solution to track or possibly prevent this? Thanks in advance Rating: 5

[Mr Happy]

OK, just a heads up report,
I cannot fix the injected links due to its embedded to the post tooo many to fix one by one, however I found the source of the problem, so hopefully it wont happen again in the future.

For some reason the hacker manage to upload a php file, named sql.php, it might be injecting the post database or altering my post when I clicked publish. The codes there are secured codes, so I cannot read it and dont have time to encode it . So I just deleted the file.

For those who are interested in the file, I am sorry, in the brink of myself, I hit the delete button, I should have save it for reference.

Thanks for all the help mates!!

What a clever hacker. It's a pitty you deleted it. We could have decoded it as it may have some include 'file.php'; which would let you know if other alien files are on your server. This sounds like a incredibly clever hacker and most likely he's left other measures to gain access to admin if needed in future etc.
You may want to consider deleting all files and reuploading them and re-uploading any plugins or modules as well obviously making a backup first. If it was done automatically when you published then you'd need more code to include the sql.php file so I doubted the sql.php is the only file.

Anyway it's good to see you found the problem.