Plugin Leak?

  • Hi,

    For 2 weeks I’ve got “Louis Vuitton” look-a-like spam on my website and can’t figure out where the spam comes from. Also a articlesmap.xml is placed in the root but not as a file. When I change my user-agent to the GoogleBot I see more spam (also in the robots.txt).

    When I re-install WordPress the spam disappears. Then I figured out that wp-blog-header.php had been changed and /wp-includes/images/slider.gif is placed in a required tag…

    I’ve opened the slider.gif and saw an encrypted code that also had been encrypted. The encryption wasn’t that strong so after 5 decrypts I saw this code:

    [ Malware script deleted, please do not post those here ]

    Does anyone have an idea where the code comes from? I changed the FTP- MySQLAdmin- and WP-logins several times but they change the code every time.

    These are the plugins that I use:

    • Advanced Custom Fields
    • Contact Form 7
    • Cubell Themes
    • Custom Recent Posts Widget
    • Easy FancyBox
    • Easy Table
    • Envato WordPress Toolkit
    • Events Manager
    • Floating Social Bar
    • Google Sitemap
    • Image Widget
    • Jetpack door WordPress.com
    • List category posts
    • PHP Code Widget
    • Pre Date Future Post
    • Simple Ads Manager
    • Weptile Image Slider Widget
    • WordPress Popular Posts
    • WP Super Cache
    • Yop Poll Plugin

    Thank you for your help.

Viewing 4 replies - 1 through 4 (of 4 total)
Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Plugin Leak?’ is closed to new replies.