A bunch of malware files. How?

  • Resolved LoganSix

    (@logansix)


    9 years, 6 months ago

    I got a list of malware files from my ISP.
    How do they get there?
    What can I do to prevent this from happening?

    My WordPress site automatically updates.
    I haven’t given any access beyond the normal access when installing.

    /wp-content/themes/creativity-bulb-10/functions.php (known malicious file; matched malware: LONGDEF.PHP.Spam-Links-009N.UNOFFICIAL)
    /wp-content/themes/creativity-bulb-10/images/img6_new.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-24.UNOFFICIAL)
    /wp-content/themes/creativity-bulb-10/comments_prevv1.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-24.UNOFFICIAL)
    /wp-content/themes/index_ver1.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-24.UNOFFICIAL)
    /wp-admin/maint/repair_backup.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-23.UNOFFICIAL)
    /wp-admin/css/colors/light/colors-rtl_prevv1.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-23.UNOFFICIAL)
    /wp-admin/css/colors/ocean/colors-rtl_ver1.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-23.UNOFFICIAL)
    /wp-admin/css/colors/blue/colors.min_backup.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-23.UNOFFICIAL)
    /wp-admin/css/colors/sunrise/colors_old.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-23.UNOFFICIAL)
    /wp-admin/css/colors/coffee/colors_infoold.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-23.UNOFFICIAL)
    /wp-admin/user/user-edit_noversion.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-23.UNOFFICIAL)
    /wp-admin/credits_indesit.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-23.UNOFFICIAL)
    /wp-admin/network/users_infoold.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-23.UNOFFICIAL)
    /wp-admin/images/resize-rtl-2x_infoold.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-23.UNOFFICIAL)
    /wp-includes/SimplePie/Restriction_infoold.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-22.UNOFFICIAL)
    /wp-includes/Text/Diff/Renderer_backup.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-22.UNOFFICIAL)
    /wp-includes/Text/Diff/Engine/shell_infoold.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-22.UNOFFICIAL)
    /wp-includes/fonts/dashicons_backup.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-22.UNOFFICIAL)
    /wp-includes/js/mediaelement/wp-playlist_indesit.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-22.UNOFFICIAL)
    /wp-includes/js/swfupload/plugins/swfupload.speed_noversion.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-22.UNOFFICIAL)
    /wp-includes/js/swfupload/swfupload_bck_old.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-22.UNOFFICIAL)
    /wp-includes/js/tinymce/plugins/directionality/plugin_infoold.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-22.UNOFFICIAL)
    /wp-includes/js/tinymce/plugins/image/plugin_noversion.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-22.UNOFFICIAL)
    /wp-includes/js/tinymce/skins/wordpress/images/playlist-video_new.php (known malicious file; matched malware: JCDEF.Obfus.CreateFunc.BackDoorEval-22.UNOFFICIAL)

Viewing 3 replies - 1 through 3 (of 3 total)

  • I am sorry to hear your site is damaged. Do you or your hosting company have a full backup of your site? The fastest and most sure way to repair your site is to restore from a backup made before the hack.

    Without a backup your only permanent solution is to repair the site. Follow this guide.

    When you’re done, you may want to implement some (if not all) of the recommended security measures.

    Most of the times just getting rid of bad code you should make sure you have a clean site and set up a new secure password and dont use the old one.

    You should delete all files and reupload them (and make sure that you got all files by makign sure there are no hidden files/folders other than .htaccess). You should get proper protection against bruteforceattacks and bad/failed login lockouts.

    Thread Starter LoganSix

    (@logansix)

    The site wasn’t damaged, but the hosting company deactivated the site until I removed the files.
    I already deleted the malicious files and one entire theme, to get multiple files. And I changed my site owner password. I will update my WordPress admin passwords later.

    I also added the secondary security measures from the guide.

    Hopefully that will help keep this from happening. Kind of bad timing for my site to be taken down, because I just made a release to an app and I was going to release a post about it. Also, there are a few pages that the app uses.

    Oh well, hopefully they are quick enough to bring it back up.
    I guess I will mark this as resolved.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘A bunch of malware files. How?’ is closed to new replies.

Tags