I maintain three wordpress blogs, all hosted at WebFaction. And suddenly this morning, inside all my
iframe with some source it will need to load, but only if the user-agent and ip are not in the list of blocked ips, or blocked bots. My guess: to make sure your site will not be blacklisted, but any visitor will still get spammed. Ok. But how to fix this? First thing was easy: just edit the
index.php and fix it! Remove the eval-line! Secondly I notified my host of this. One blog was not using the latest version, so i updated that one. I verified the files of all my blogs against the latest version of Wordpress (3.1.3), and they were all identical except for the mentioned
index.php. I changed my ssh/ftp password, because if the attacker had access to all three sites, that seemed to the only option. But within two hours the index-files where hacked again. Ok. This was getting serious. I installed the following plugins:
base64_decode. Only my
index.phpseem to be touched, but a lot of plugins have code that seems fishy, but I think they are not. I am not seeing any obviously wrong code now. So I am still a bit weary how the
index.phpcould get hacked again.
wp-config.php. I asked my hoster for the log-files. I hope to see something suspicious there. My
index.phphave not yet been overwritten again, so I hope this will do. I will keep you posted.
What has transpired since then? I have found the exact same problem on my sites! I'm taking your steps, but wondered if anything had changed on your end since this post?
Hi Justin, since then nothing has changed. I am still a bit in the dark why or how it happened, but at least the measures I took now seem to be helping. And as soon as my files will get tampered with again, the Wordpress File Monitor will notify me. I am guessing the Bullet Proof Security closed some open doors? I hope these steps are helping you as well.
Super helpful. Thank you for these steps. I'm still tangling with this nasty piece of code, but I'll get there. Question: What did you use to decode the injected eval code? I'd like to take a look at mine to see if I can pinpoint what it's doing. Thanks so much for the resource!
See here (and the comment I wrote below) http://wpmu.org/wordpress-security-exploit-found-upgrade-wptouch-addthis-and-w3-total-cache/comment-page-1/
@Justice Wise If you want to look at the injected code, just take out the call to eval() and make it a string assignment. Here's what I did: [bash] $badcode = base64_decode(.....); echo "<!-- \n\n/*\n\n$badcode\n\n*/\n\n -->"; [/bash]
Oh meh... stupid website f'ed up my echo command instead of properly escaping things. The echo command basically printed the $badcode string within a comment block.
@Mike: I fixed that for you. @Justice: I used this <a href="http://www.motobit.com/util/base64-decoder-encoder.asp" rel="nofollow">online decoder</a>
Do we know what the original infection vector for this was?
@Mike: I see your site is still infected. I am not entirely sure I understand your question, but I do not know how I got infected or what caused it.
@nathanvda: Thanks... didn't realize the comment setup would take BBCode or HTML for a code block.
Thanks for the article. I am also fighting with the malicious code and it always gets regenerated.. I guess that one of the admins has his computer virused..
I had the same trouble on one of my blogs. One of my other site files had a backdoor added to allow the hacker to replace the code any time. I wrote a blog post about clearing it up: http://www.dconstructing.com/php/2011/09/02/cleaning-wordpress-of-malicious-code/
I am having the same problem on one site: http://vencanice.eu It is WordPress Latest version 3.21 (now) My qestion is how do they get in to WordPress?
This post solved my problems. I was in trouble since some days ago, glad I found it. I had exactly the same problem, I think that bulletproof security creating new .htacces file was the key.
I host several sites on my server for development - I had 2 ready to copy to production logging in I see that every php file on every instance of wordpress has been comprimised and all of the dev sites are down. Can any one help getting this fixed? Thanks
The problem si timthumb.php. My website have been attacked like this by timthumb.php. I had to modify my theme and use Timthumb alternative (search google).
Hi Pavel, I am glad you were able to find the cause on your own website. Personally I have never used TimThumb. Understand that any php-script can be modified to have this hack.
Hi I have same problem in my opencart website, Did you find any Solution?
The article describes each step I took, and together that solved it on my sites. Was that not clear? Do you mean something more specific?
the steps on this page saved me.. thanks! for monitoring I also created a php malware scanner script that would scan for malware inserted code which includes eval(base64_decode... and other inserted codes on .htaccess and js files... see details for the script here http://ombing.info/2012/10/20/php-malware-scanner/