download update.exe?

Nevermind, Its still attempting to download that update.exe. this is really bad.

Hey dealbas,

Try My method. I got rid of that.

Please help me..I’ve the same problem (update.exe automatic download).
I can’t see where is the problem and I’m not able to fix it..please help me I don’t know what I can do.
site url:
https://www.tacchettiasei.it

I’ve find this guide online:

Solution :

Login to Database through PHPMyadmin
In your wp_options (orwp_ID_options on multisite) there’s a row / option called ‘wp_data_newa’. Will investigate further to see who’s responsible for this but for now you can (temporarily!) fix it by removing it with an SQL statement:
DELETE FROM wp_options WHERE option_name like ‘%wp_data_newa%’
Make sure to adjust your table prefix.

It says that it is a temporarily fix..so I will have on my site another time update.exe on automatic download?! Please help me..

Look for file(s) named social.png and open it with notepad; if there’s PHP code in there, delete it as it is clearly not an image. Then run the SQL queries posted earlier to remove code from the database. If you cannot find the fake image that runs the PHP script, I’m afraid you’ll need to run the SQL code to remove the download script each time it’s activated on your site.
I still don’t know how this got on my site in the first place. Quite annoying.

Thank You marius.cucuruz! should i delete the social.png itself or the codes in it?

Thank you so much marius.cucuruz! i don’t usually post on forums.. But this is really helpful.. ^_^

found it searching for social.png and removed the sql entry. and changed my Authentication Unique Keys and Salts. any other suggestions?

Changing the Salts and Auth Keys is really good. Also, having looked at the script in social.png, I’ve decided to add this to my wp-config.php to prevent it from running again:
define( 'WP_OPTION_KEY', '');
Then removing the social.png file should have covered everything I guess.

Any other ideas or suggestions are welcomed.

I got a email about my wp-config being modified, i searched for ‘%wp_data_newa%’ in mysql and sure enough i found an entry, i did another search for ‘social.png’ and there was another one in other plugin! deleted both, hopefully its gone for good.

now im not able to get to wp-admin or login all that i see is ‘Warning: include(): Failed opening ‘images/social.png’ for inclusion (include_path=’.:/opt/php54/lib/php’) ‘ im checking the file using ftp to see whats going on..
anyone know what the /opt/php54/lib/php is?

ok, found this ‘<?php include(‘images/social.png’); ?>’ at the end of the php script. easy enough to find, deleted it and everything seems fine for the time being at least…

excellent find, dealbas! where exactly was it? was it in /plugins/ directory in a functions.php file?

it was the actual plugin file,in my case it was in
jck_woothumbs/jck_woothumbs.php