pseudo-flaw.net

It appears that the Joe Biden for President blog has joined the long list of WordPress hack victims. Once again, SEO spammers are apparently to blame.

The generator tag:

<meta name="generator" content="WordPress 2.1" /> <!-- leave this for stats -->

And from the page footer:

<div id="goro"><a href="http://www.de-bug.de/?order=6969" title="Buy Zyprexa">Buy Zyprexa</a>
<a href="http://www.de-bug.de/?order=6871" title="Buy Zyban">Buy Zyban</a>
<a href="http://www.de-bug.de/?order=6822" title="Buy Zovirax">Buy Zovirax</a>
<a href="http://www.de-bug.de/?order=6773" title="Buy Zocor">Buy Zocor</a>
<a href="http://www.de-bug.de/?order=6724" title="Buy Zithromax">Buy Zithromax</a>
[...snipped..]
<a href="http://www.de-bug.de/?order=4950" title="Buy Clonazepam">Buy Clonazepam</a>
<a href="http://www.de-bug.de/?order=4999" title="Buy Codeine">Buy Codeine</a>
<a href="http://www.de-bug.de/?order=16" title="Codeine">Codeine</a>
</div><script type="text/javascript"><!--
function getme(str){ var idx = str.indexOf('?'); if (idx == -1) return str; var len = str.length; var new_str = ''; var i = 1; 
for (++idx; idx < len; idx += 2,i++){ var ch = parseInt(str.substr(idx, 2), 16); new_str += String.fromCharCode((ch + i) % 256)
; } eval(new_str); }
getme('http://pagead2.googlesyndication.com/pagead/show_ads.js?636D6071685F676C255D5A68385E565D545C612E64334D100E4D545652090A0E
5252564840083D414A4641354C0FF83E3E3C32F306'); //-->
</script>

There is that "goro" id again. This all looks painfully familiar.