<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
		>
<channel>
	<title>Comments on: Hidden Wordpress Spam: </title>
	<atom:link href="http://linuxsysadminblog.com/2009/05/hidden-wordpress-spam/feed/" rel="self" type="application/rss+xml" />
	<link>http://linuxsysadminblog.com/2009/05/hidden-wordpress-spam/</link>
	<description>System admins of Promet - an e-commerce, high availability Open Source web shop - share their findings</description>
	<lastBuildDate>Mon, 26 Jul 2010 15:47:29 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
		<item>
		<title>By: James</title>
		<link>http://linuxsysadminblog.com/2009/05/hidden-wordpress-spam/comment-page-1/#comment-381</link>
		<dc:creator>James</dc:creator>
		<pubDate>Sat, 13 Jun 2009 23:42:47 +0000</pubDate>
		<guid isPermaLink="false">http://linuxsysadminblog.com/?p=680#comment-381</guid>
		<description>I found spam on many wordpress pages lately:
http://www.crie.be/temp/common.php?p=viagra-dosaggio
http://www.lakemichigancollege.edu/foundation/dream/.oem/autodesk-autocad-civil-3d-land-desktop-companion-2009.html
http://arts.utah.gov/apps/calendar/languages/de.php?p=acala-dvd-audio-ripper
http://www.educarex.es/debateeducacion/debates.php?p=acala-dvd-audio-ripper

These appear to be infected with c99 and then using wordpress to broadcast as to hide where they insert the script.

Let me know if you find anything else out.</description>
		<content:encoded><![CDATA[<p>I found spam on many wordpress pages lately:<br />
<a href="http://www.crie.be/temp/common.php?p=viagra-dosaggio" rel="nofollow">http://www.crie.be/temp/common.php?p=viagra-dosaggio</a><br />
<a href="http://www.lakemichigancollege.edu/foundation/dream/.oem/autodesk-autocad-civil-3d-land-desktop-companion-2009.html" rel="nofollow">http://www.lakemichigancollege.edu/foundation/dream/.oem/autodesk-autocad-civil-3d-land-desktop-companion-2009.html</a><br />
<a href="http://arts.utah.gov/apps/calendar/languages/de.php?p=acala-dvd-audio-ripper" rel="nofollow">http://arts.utah.gov/apps/calendar/languages/de.php?p=acala-dvd-audio-ripper</a><br />
<a href="http://www.educarex.es/debateeducacion/debates.php?p=acala-dvd-audio-ripper" rel="nofollow">http://www.educarex.es/debateeducacion/debates.php?p=acala-dvd-audio-ripper</a></p>
<p>These appear to be infected with c99 and then using wordpress to broadcast as to hide where they insert the script.</p>
<p>Let me know if you find anything else out.</p>
]]></content:encoded>
	</item>
</channel>
</rss>
