Website footer hacks

[twrg]

Hola, I have posted on this before and thought the problem was fixed. But after the fourth time it is quite tiresome to have spam footer links added to my website. grrrr

http://www.twresourcegroup.com and the links can be viewed at http://209.85.173.132/search?q=cache...UJA:en&strip=1.

Some of the fixes I've done are: cleared the footer file and reloaded it, reloaded themes, deleted themes and reloaded. But I am no coding expert. Anyone have any ideas how to remove and prevent this from occuring?

Thanks for the help.

[redsox9]

Are you using CMS software? Are there updates available that phase out possible security risks or holes?

[twrg]

Using Wordpress that was installed through Fantastico and running the latest version of Wordpress (use Automatic upgrade plugin). Oh yea, changed passwords too.

[twrg]

Another note, I have 3 other domains associated with the account that are uses the same file storage and they have not been affected.

- http://www.ko3a.net
- http://www.goingbigger.org
- http://www.crossroads-connection.com

I'm baffled.

[Early Out]

I'm no Wordpress expert (to say the least!), but I'd be suspicious of the one theme that's getting hacked.

[twrg]

I have changed themes while removing all the old theme files prior to this intrusion.

[gingerwave]

I have several WP blogs and have never had a problem. I would like to know the solution if you find it. Very interesting.

[Nancy]

I had a hack couple weeks ago. The only way I could track it was to download the control log file into an Excel spreadsheet and go through it with a fine tooth comb to see what files were being accessed and where the hole was the hacker used.

In my case it turned out to be a vulnerability in a php scripting program I had downloaded. From there they uploaded a hacked SHELL program and could have touched everything and anything they wanted to on my site.

I removed the offending app. Deleted the SHELL program (which was installed in multiple directories by that point. And continued to monitor the Control Logs for the next few days to confirm the door was closed.

Good luck.