Activating Plugins enables malicious code….

  • I’ve had a client contact me about a site that has been comprimised…

    I currently have all plugins de-activated, and the bad code doesn’t present itself, but up activating a plugin (any plugin, even trusted ones) it is enabling some malicious code to be called via the wp_footer() call….

    I’ve re-uploaded 2.9.1 to overright any system files, but did nothing to help.

    I’ve searched for such strings as “document.write”, “base64” and “decode” without success in identifying where the malicious code is entering the stream.

    When I first got the site back up, my AV alarms went off alerting me to the problem before I could even see it.

    Any thoughts on where else I need to look for this?

    The database is next for me to grep through, but thought I’d get some more opinions first…

    Thanks

    Matt

Viewing 4 replies - 1 through 4 (of 4 total)
Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Activating Plugins enables malicious code….’ is closed to new replies.