The tricky part is, that if you are the site owned, it will NOT be visible to you. Unless you have the habbit of clearing your cookies. What the hack did was modify the wp_posts (or other prefixes) table, and modify the post_content by placing

<script src="xxxxxxxxxxxxxx"></script">

at the end of the line (of course, xxxxx is a URL which I have removed because of security reasons). So, if you are experiencing the same problem, go into your database, and see if you see a <script in your _posts table, in the post_content field.

What does the script do? Well is basicly comes down to his

1. The script determines if you have visited the website already (by looking through your cookies)
2. If you have already visited the website, it will just show you the normal page (so if you are the site owner you won't notice if your site has been affected if you don't clear your cookies)
3. If you haven't visisted the website, if will redirect you (through a tinyurl)

I fixed it by backing up the database, then dropping the _posts table , editing the sql for the _posts table , and did a replace all on the <script .. problems were solved after this.

I hope this helps some of you

When you submit a form with cforms and you use the qtranslate plugin, it automatically goes to the back to the default language page, and the form does not submit. Are you having this issue? The solution is below

Solution:

find

$content .= $ntt . '<form enctype="multipart/form-data" action="' . $action . '" method="post" class="cform'.( $cformsSettings['form'.$no]['cforms'.$no.'_dontclear']?' cfnoreset':'' ).'" id="cforms'.$no.'form"&gt;' . $nl;

insert the following BEFORE $content .= $ntt ..

if(strstr(get_locale(),'xx')!="") $action = '/xx'.$action;

replace xx with the two letter language code of the non default language

I found following error in their eventviewer:
Faulting application OUTLOOK.EXE, version 12.0.6514.5000, time stamp 0x4a89dc70, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821, exception code 0xc0000374, fault offset 0x000afaf8, process id 0x14f4, application start time 0x01ca830f85dbedc2.

Maybe a plugin was causing this issues. Running outlook in safe mode disables all the plugins.
You can start outlook in safe mode by right clicking on the shortcut, select properties and add following parameter at the end of the Target command /safe
so your target should be something like this: "C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" /recycle /safe

After letting one of the users who experienced these problems start outlook in safe mode, outlook didn't crash anymore. So, one of the plugins was causing the problems.

After comparing the plugins, the "problem" users were using. I noticed that the only similar (and not standard) plugin was "PDFMOUTLOOK", a plugin from adobe. This must be the plugin causing the crashes ! Go in outlook to tools > Trust Center > Add-ins to view all installed plugins.

I let the users remove the plugin ! You can remove a plugin by going to the Outlook tools menu > Trust Center > Add-ins > Manage: COM add-ins > Go. In this window you can select a plugin and click remove.

Regards,
Valérie

Note: If you only have one user with this problem you can start outlook in safe mode and enable plugins one by one, and see on which one it crashes.

Try downloading the wordpress package from Wordpress.org ,
delete the wp-admin / wp-includes directory from your FTP,and reupload the correct files.

If you're still getting javascript errors ( like a broken editor, stuck in Visual mode with white text) , you could try adding the following to your wp-config.php

define('CONCATENATE_SCRIPTS', false );
or

define('SCRIPT_DEBUG', true);

So, to get the activation URL I used a BeanShell PostProcessor. If you use BeanShell you need to place bsh-2.0b4.jar in the JMeter lib directory.
The URL I needed to check was from the following format: https://www.[domain].be/Action.do?URL=[Activation Code]"
I only needed the Activation Code. This is the BeanShell PostProcessor code I used:

import org.apache.jmeter.samplers.SampleResult;

counter = 1;
temp=null;
newVal = "INVALID";

//get all mails
results = prev.getSubResults();
	for(SampleResult result: results) {
		mail = result.getResponseDataAsString();
                //check sender and subject
		if(mail.contains("From: [Sender]") && mail.contains("Subject: [Subject]")) {
                        //get URL
			temp = mail.split("URL=");
			temp = temp[1].split(”\”>”);
			newVal = temp[0];
		}
        //put url in JMeter variable
	vars.put("activationCode", newVal);
	counter++;
	}

The Activation code is now in the JMeter variable: $[activationCode] which can be accessed from Samplers, Pre & Post-Processors,...
To access this variable, you need to define it in JMeters User Defined Variables first. Otherwise JMeter doesn't know about it existence.

I used a split to get the activation code out of the URL, you could also use a regex which would be something like this: .*URL=([^"]*).*