Affected versions: 2.3.3 and older, possibly more

Symptoms:

• Presence of wp-info.txt
• Displayed version changed without upgrading.
• Database modifications
• New files ending in _new, _old, .pngg, .jpgg, .giff appearing inside writable directory

Please add details and fixes.

• Remove _new/_old/.pngg/.jpgg/.giff files across entire server. This requires shell access and sudo/su privilages:
  • sudo find / -name wp-info.txt -exec /bin/rm -f '{}' \;
  • sudo find / -name *_new.php -exec /bin/rm -f '{}' \;
  • sudo find / -name *_old.php -exec /bin/rm -f '{}' \;
  • sudo find / -name *php.pngg -exec /bin/rm -f '{}' \;
  • sudo find / -name *php.jpgg -exec /bin/rm -f '{}' \;
  • sudo find / -name *php.giff -exec /bin/rm -f '{}' \;

Existing conversation found at:

• http://wordpress.org/support/topic/168964
• http://wordpressphilippines.org/blog/has-your-wordpress-been-hacked-recently/

Simptoms, identifying the virus and how to get rid of it found at:

• http://www.bloggerguide.net/blog-platform/wordpress/wordpress-exploit-giving-backlinks-redirects-and-headaches-but-no-visitors/

See also

• User:Here/Exploits -- Other documented exploits