keep getting it so that google reports this blog as “buy difoclenac without prescription”
Here’s how to test if yours is infected (wordpress, as lteast):
wget -U "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.htm" yourblog.com
or
curl -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.htm" yourblog.com
and search for title.
Example:
$ curl -A "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.htm" betterlogic.com/roger/ | grep title | head
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
10 30135 10 3258 0 0 4176 0 0:00:07 --:--:-- 0:00:07 4641 <title>Buy Diclofenac Without Prescription</title>
<link rel='archives' title='July 2012' href='http://betterlogic.com/roger/2012/07/' />
<link rel='archives' title='June 2012' href='http://betterlogic.com/roger/2012/06/' />
<link rel='archives' title='May 2012' href='http://betterlogic.com/roger/2012/05/' />
<link rel='archives' title='April 2012' href='http://betterlogic.com/roger/2012/04/' />
<link rel='archives' title='March 2012' href='http://betterlogic.com/roger/2012/03/' />
<link rel='archives' title='February 2012' href='http://betterlogic.com/roger/2012/02/' />
<link rel='archives' title='January 2012' href='http://betterlogic.com/roger/2012/01/' />
<link rel='archives' title='December 2011' href='http://betterlogic.com/roger/2011/12/' />
<link rel='archives' title='November 2011' href='http://betterlogic.com/roger/2011/11/' />
100 30135 100 30135 0 0 32719 0 --:--:-- --:--:-- --:--:-- 35747
Temporary fix is to reinstall wordpress.
Not sure how the compromise occurred.
Buy Diclofenac Without Prescription
or
Buy Diovan Without Prescription
were symptoms. Man this sucks it just keeps coming back…