doby

People thank you for your interest.

This happens on two different hostings. I’m trying to find out what is common. Looks like themes and one plugin, for two sites on different hostings, that I currently turned off/delete, and waiting, what’s going to happen.

In the meantime, I locked the write attributes on all files, with FTP account. Which are all changed after attacks, to write?!?

Although I changed the ftp account password. Currently it is off, also.

Thank you again

Sorry for spamming, but this is the same as smjohnson problem, that I wrote on Thursday, and no one has replied?

Hi, same here.
Codes are changing chaotic at the beginning. It happened to me on Thursday, same today. I returned backups, all the latest plugins and WordPress, and the same. I use Wordfence??? No way to determine from where is malware .. when I am scanning sites external, everything it’s ok??

Hi, same here, even are “damaged” elements in old newsletters .. please help

Hi, same here – optimum FIREWALL…. thank you very much

Now, when I am returned backup, seems all right, but how it happened

every php file has this chaotic beginning and I can not find anything about it

[ Malware deleted, please do not post that in these forums. ]

Thank you very much, but the latest version of Wordfence is active… all the latest plugins, and it happened at the same time on multiple sites

Wordfence send me this on email…

Alert generated at Thursday 17th of July 2014 at 08:09:48 PM
Critical Problems:

* WordPress core file modified: index.php
* WordPress core file modified: wp-activate.php
* WordPress core file modified: wp-admin/about.php
* WordPress core file modified: wp-admin/admin-ajax.php
* WordPress core file modified: wp-admin/admin-footer.php
* WordPress core file modified: wp-admin/admin-functions.php
* WordPress core file modified: wp-admin/admin-header.php
* WordPress core file modified: wp-admin/admin-post.php
* WordPress core file modified: wp-admin/admin.php
* WordPress core file modified: wp-admin/async-upload.php
* WordPress core file modified: wp-admin/comment.php
* WordPress core file modified: wp-admin/credits.php
* WordPress core file modified: wp-admin/custom-background.php
* WordPress core file modified: wp-admin/custom-header.php
* WordPress core file modified: wp-admin/customize.php
* WordPress core file modified: wp-admin/edit-comments.php
* WordPress core file modified: wp-admin/edit-form-advanced.php
* WordPress core file modified: wp-admin/edit-form-comment.php
* WordPress core file modified: wp-admin/edit-link-form.php
* WordPress core file modified: wp-admin/edit-tag-form.php
* WordPress core file modified: wp-admin/edit-tags.php
* WordPress core file modified: wp-admin/edit.php
* WordPress core file modified: wp-admin/export.php
* WordPress core file modified: wp-admin/freedoms.php
* WordPress core file modified: wp-admin/import.php
* WordPress core file modified: wp-admin/includes/admin.php
* WordPress core file modified: wp-admin/includes/ajax-actions.php
* WordPress core file modified: wp-admin/includes/bookmark.php
* WordPress core file modified: wp-admin/includes/class-ftp-pure.php
* WordPress core file modified: wp-admin/includes/class-ftp-sockets.php
* WordPress core file modified: wp-admin/includes/class-ftp.php
* WordPress core file modified: wp-admin/includes/class-pclzip.php
* WordPress core file modified: wp-admin/includes/class-wp-comments-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-filesystem-base.php
* WordPress core file modified: wp-admin/includes/class-wp-filesystem-direct.php
* WordPress core file modified: wp-admin/includes/class-wp-filesystem-ftpext.php
* WordPress core file modified: wp-admin/includes/class-wp-filesystem-ftpsockets.php
* WordPress core file modified: wp-admin/includes/class-wp-filesystem-ssh2.php
* WordPress core file modified: wp-admin/includes/class-wp-importer.php
* WordPress core file modified: wp-admin/includes/class-wp-links-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-media-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-ms-sites-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-ms-themes-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-ms-users-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-plugin-install-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-plugins-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-terms-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-theme-install-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-themes-list-table.php
* WordPress core file modified: wp-admin/includes/class-wp-upgrader-skins.php
* WordPress core file modified: wp-admin/includes/class-wp-users-list-table.php
* WordPress core file modified: wp-admin/includes/comment.php
* WordPress core file modified: wp-admin/includes/continents-cities.php
* WordPress core file modified: wp-admin/includes/dashboard.php
* WordPress core file modified: wp-admin/includes/deprecated.php
* WordPress core file modified: wp-admin/includes/export.php
* WordPress core file modified: wp-admin/includes/file.php
* WordPress core file modified: wp-admin/includes/image-edit.php
* WordPress core file modified: wp-admin/includes/image.php
* WordPress core file modified: wp-admin/includes/import.php
* WordPress core file modified: wp-admin/includes/list-table.php
* WordPress core file modified: wp-admin/includes/media.php
* WordPress core file modified: wp-admin/includes/menu.php
* WordPress core file modified: wp-admin/includes/meta-boxes.php
* WordPress core file modified: wp-admin/includes/misc.php
* WordPress core file modified: wp-admin/includes/ms-deprecated.php
* WordPress core file modified: wp-admin/includes/ms.php
* WordPress core file modified: wp-admin/includes/nav-menu.php
* WordPress core file modified: wp-admin/includes/plugin-install.php
* WordPress core file modified: wp-admin/includes/plugin.php
* WordPress core file modified: wp-admin/includes/revision.php
* WordPress core file modified: wp-admin/includes/schema.php
* WordPress core file modified: wp-admin/includes/screen.php
* WordPress core file modified: wp-admin/includes/taxonomy.php
* WordPress core file modified: wp-admin/includes/template.php
* WordPress core file modified: wp-admin/includes/theme-install.php
* WordPress core file modified: wp-admin/includes/theme.php
* WordPress core file modified: wp-admin/includes/update-core.php
* WordPress core file modified: wp-admin/includes/update.php
* WordPress core file modified: wp-admin/includes/user.php
* WordPress core file modified: wp-admin/includes/widgets.php
* WordPress core file modified: wp-admin/index.php
* WordPress core file modified: wp-admin/install-helper.php
* WordPress core file modified: wp-admin/install.php
* WordPress core file modified: wp-admin/link-add.php
* WordPress core file modified: wp-admin/link-manager.php
* WordPress core file modified: wp-admin/link-parse-opml.php
* WordPress core file modified: wp-admin/link.php
* WordPress core file modified: wp-admin/load-scripts.php
* WordPress core file modified: wp-admin/load-styles.php
* WordPress core file modified: wp-admin/maint/repair.php
* WordPress core file modified: wp-admin/media-new.php
* WordPress core file modified: wp-admin/media-upload.php
* WordPress core file modified: wp-admin/media.php
* WordPress core file modified: wp-admin/menu-header.php
* WordPress core file modified: wp-admin/menu.php
* WordPress core file modified: wp-admin/moderation.php
* WordPress core file modified: wp-admin/ms-admin.php
* WordPress core file modified: wp-admin/ms-delete-site.php
* WordPress core file modified: wp-admin/ms-edit.php
* WordPress core file modified: wp-admin/ms-options.php
* WordPress core file modified: wp-admin/ms-sites.php
* WordPress core file modified: wp-admin/ms-themes.php
* WordPress core file modified: wp-admin/ms-upgrade-network.php
* WordPress core file modified: wp-admin/ms-users.php
* WordPress core file modified: wp-admin/my-sites.php
* WordPress core file modified: wp-admin/nav-menus.php
* WordPress core file modified: wp-admin/network/about.php
* WordPress core file modified: wp-admin/network/admin.php
* WordPress core file modified: wp-admin/network/credits.php
* WordPress core file modified: wp-admin/network/edit.php
* WordPress core file modified: wp-admin/network/freedoms.php
* WordPress core file modified: wp-admin/network/index.php
* WordPress core file modified: wp-admin/network/menu.php
* WordPress core file modified: wp-admin/network/plugin-editor.php
* WordPress core file modified: wp-admin/network/plugin-install.php
* WordPress core file modified: wp-admin/network/plugins.php
* WordPress core file modified: wp-admin/network/profile.php
* WordPress core file modified: wp-admin/network/settings.php
* WordPress core file modified: wp-admin/network/setup.php
* WordPress core file modified: wp-admin/network/site-info.php
* WordPress core file modified: wp-admin/network/site-new.php
* WordPress core file modified: wp-admin/network/site-settings.php
* WordPress core file modified: wp-admin/network/site-themes.php
* WordPress core file modified: wp-admin/network/site-users.php
* WordPress core file modified: wp-admin/network/sites.php
* WordPress core file modified: wp-admin/network/theme-editor.php
* WordPress core file modified: wp-admin/network/theme-install.php
* WordPress core file modified: wp-admin/network/themes.php
* WordPress core file modified: wp-admin/network/update-core.php
* WordPress core file modified: wp-admin/network/update.php
* WordPress core file modified: wp-admin/network/upgrade.php
* WordPress core file modified: wp-admin/network/user-edit.php
* WordPress core file modified: wp-admin/network/user-new.php
* WordPress core file modified: wp-admin/network/users.php
* WordPress core file modified: wp-admin/network.php
* WordPress core file modified: wp-admin/options-discussion.php
* WordPress core file modified: wp-admin/options-general.php
* WordPress core file modified: wp-admin/options-head.php
* WordPress core file modified: wp-admin/options-media.php
* WordPress core file modified: wp-admin/options-permalink.php
* WordPress core file modified: wp-admin/options-reading.php
* WordPress core file modified: wp-admin/options-writing.php
* WordPress core file modified: wp-admin/options.php
* WordPress core file modified: wp-admin/plugin-editor.php
* WordPress core file modified: wp-admin/plugin-install.php
* WordPress core file modified: wp-admin/plugins.php
* WordPress core file modified: wp-admin/post-new.php
* WordPress core file modified: wp-admin/post.php
* WordPress core file modified: wp-admin/press-this.php
* WordPress core file modified: wp-admin/profile.php
* WordPress core file modified: wp-admin/revision.php
* WordPress core file modified: wp-admin/setup-config.php
* WordPress core file modified: wp-admin/theme-editor.php
* WordPress core file modified: wp-admin/theme-install.php
* WordPress core file modified: wp-admin/tools.php
* WordPress core file modified: wp-admin/update-core.php
* WordPress core file modified: wp-admin/update.php
* WordPress core file modified: wp-admin/upgrade-functions.php
* WordPress core file modified: wp-admin/upgrade.php
* WordPress core file modified: wp-admin/upload.php
* WordPress core file modified: wp-admin/user/about.php
* WordPress core file modified: wp-admin/user/admin.php
* WordPress core file modified: wp-admin/user/credits.php
* WordPress core file modified: wp-admin/user/freedoms.php
* WordPress core file modified: wp-admin/user/index.php
* WordPress core file modified: wp-admin/user/menu.php
* WordPress core file modified: wp-admin/user/profile.php
* WordPress core file modified: wp-admin/user/user-edit.php
* WordPress core file modified: wp-admin/user-edit.php
* WordPress core file modified: wp-admin/user-new.php
* WordPress core file modified: wp-admin/users.php
* WordPress core file modified: wp-admin/widgets.php
* WordPress core file modified: wp-blog-header.php
* WordPress core file modified: wp-comments-post.php
* WordPress core file modified: wp-config-sample.php
* WordPress core file modified: wp-cron.php
* WordPress core file modified: wp-includes/ID3/getid3.lib.php
* WordPress core file modified: wp-includes/ID3/getid3.php
* WordPress core file modified: wp-includes/ID3/module.audio-video.asf.php
* WordPress core file modified: wp-includes/ID3/module.audio-video.flv.php
* WordPress core file modified: wp-includes/ID3/module.audio-video.matroska.php
* WordPress core file modified: wp-includes/ID3/module.audio-video.quicktime.php
* WordPress core file modified: wp-includes/ID3/module.audio-video.riff.php
* WordPress core file modified: wp-includes/ID3/module.audio.ac3.php
* WordPress core file modified: wp-includes/ID3/module.audio.dts.php
* WordPress core file modified: wp-includes/ID3/module.audio.flac.php
* WordPress core file modified: wp-includes/ID3/module.audio.mp3.php
* WordPress core file modified: wp-includes/ID3/module.audio.ogg.php
* WordPress core file modified: wp-includes/ID3/module.tag.apetag.php
* WordPress core file modified: wp-includes/ID3/module.tag.id3v1.php
* WordPress core file modified: wp-includes/ID3/module.tag.id3v2.php
* WordPress core file modified: wp-includes/ID3/module.tag.lyrics3.php
* WordPress core file modified: wp-includes/SimplePie/Author.php
* WordPress core file modified: wp-includes/SimplePie/Cache/Base.php
* WordPress core file modified: wp-includes/SimplePie/Cache/DB.php
* WordPress core file modified: wp-includes/SimplePie/Cache/File.php
* WordPress core file modified: wp-includes/SimplePie/Cache/Memcache.php
* WordPress core file modified: wp-includes/SimplePie/Cache/MySQL.php
* WordPress core file modified: wp-includes/SimplePie/Cache.php
* WordPress core file modified: wp-includes/SimplePie/Caption.php
* WordPress core file modified: wp-includes/SimplePie/Category.php
* WordPress core file modified: wp-includes/SimplePie/Content/Type/Sniffer.php
* WordPress core file modified: wp-includes/SimplePie/Copyright.php
* WordPress core file modified: wp-includes/SimplePie/Core.php
* WordPress core file modified: wp-includes/SimplePie/Credit.php
* WordPress core file modified: wp-includes/SimplePie/Decode/HTML/Entities.php
* WordPress core file modified: wp-includes/SimplePie/Enclosure.php
* WordPress core file modified: wp-includes/SimplePie/Exception.php
* WordPress core file modified: wp-includes/SimplePie/File.php
* WordPress core file modified: wp-includes/SimplePie/HTTP/Parser.php
* WordPress core file modified: wp-includes/SimplePie/IRI.php
* WordPress core file modified: wp-includes/SimplePie/Item.php
* WordPress core file modified: wp-includes/SimplePie/Locator.php
* WordPress core file modified: wp-includes/SimplePie/Misc.php
* WordPress core file modified: wp-includes/SimplePie/Net/IPv6.php
* WordPress core file modified: wp-includes/SimplePie/Parse/Date.php
* WordPress core file modified: wp-includes/SimplePie/Parser.php
* WordPress core file modified: wp-includes/SimplePie/Rating.php
* WordPress core file modified: wp-includes/SimplePie/Registry.php
* WordPress core file modified: wp-includes/SimplePie/Restriction.php
* WordPress core file modified: wp-includes/SimplePie/Sanitize.php
* WordPress core file modified: wp-includes/SimplePie/Source.php
* WordPress core file modified: wp-includes/SimplePie/XML/Declaration/Parser.php
* WordPress core file modified: wp-includes/SimplePie/gzdecode.php
* WordPress core file modified: wp-includes/Text/Diff/Engine/native.php
* WordPress core file modified: wp-includes/Text/Diff/Engine/shell.php
* WordPress core file modified: wp-includes/Text/Diff/Engine/string.php
* WordPress core file modified: wp-includes/Text/Diff/Engine/xdiff.php
* WordPress core file modified: wp-includes/Text/Diff/Renderer/inline.php
* WordPress core file modified: wp-includes/Text/Diff/Renderer.php
* WordPress core file modified: wp-includes/Text/Diff.php
* WordPress core file modified: wp-includes/admin-bar.php
* WordPress core file modified: wp-includes/atomlib.php
* WordPress core file modified: wp-includes/author-template.php
* WordPress core file modified: wp-includes/bookmark-template.php
* WordPress core file modified: wp-includes/cache.php
* WordPress core file modified: wp-includes/canonical.php
* WordPress core file modified: wp-includes/capabilities.php
* WordPress core file modified: wp-includes/category-template.php
* WordPress core file modified: wp-includes/category.php
* WordPress core file modified: wp-includes/class-IXR.php
* WordPress core file modified: wp-includes/class-feed.php
* WordPress core file modified: wp-includes/class-http.php
* WordPress core file modified: wp-includes/class-json.php
* WordPress core file modified: wp-includes/class-oembed.php
* WordPress core file modified: wp-includes/class-phpass.php
* WordPress core file modified: wp-includes/class-phpmailer.php
* WordPress core file modified: wp-includes/class-pop3.php
* WordPress core file modified: wp-includes/class-simplepie.php
* WordPress core file modified: wp-includes/class-smtp.php
* WordPress core file modified: wp-includes/class-snoopy.php
* WordPress core file modified: wp-includes/class-wp-admin-bar.php
* WordPress core file modified: wp-includes/class-wp-ajax-response.php
* WordPress core file modified: wp-includes/class-wp-customize-control.php
* WordPress core file modified: wp-includes/class-wp-customize-manager.php
* WordPress core file modified: wp-includes/class-wp-customize-section.php
* WordPress core file modified: wp-includes/class-wp-customize-setting.php
* WordPress core file modified: wp-includes/class-wp-customize-widgets.php
* WordPress core file modified: wp-includes/class-wp-editor.php
* WordPress core file modified: wp-includes/class-wp-embed.php
* WordPress core file modified: wp-includes/class-wp-error.php
* WordPress core file modified: wp-includes/class-wp-http-ixr-client.php
* WordPress core file modified: wp-includes/class-wp-image-editor-gd.php
* WordPress core file modified: wp-includes/class-wp-image-editor-imagick.php
* WordPress core file modified: wp-includes/class-wp-image-editor.php
* WordPress core file modified: wp-includes/class-wp-theme.php
* WordPress core file modified: wp-includes/class-wp-walker.php
* WordPress core file modified: wp-includes/class-wp.php
* WordPress core file modified: wp-includes/class.wp-dependencies.php
* WordPress core file modified: wp-includes/class.wp-scripts.php
* WordPress core file modified: wp-includes/class.wp-styles.php
* WordPress core file modified: wp-includes/comment.php
* WordPress core file modified: wp-includes/compat.php
* WordPress core file modified: wp-includes/cron.php
* WordPress core file modified: wp-includes/date.php
* WordPress core file modified: wp-includes/default-constants.php
* WordPress core file modified: wp-includes/default-filters.php
* WordPress core file modified: wp-includes/default-widgets.php
* WordPress core file modified: wp-includes/deprecated.php
* WordPress core file modified: wp-includes/feed-atom-comments.php
* WordPress core file modified: wp-includes/feed-atom.php
* WordPress core file modified: wp-includes/feed-rdf.php
* WordPress core file modified: wp-includes/feed-rss.php
* WordPress core file modified: wp-includes/feed-rss2-comments.php
* WordPress core file modified: wp-includes/feed-rss2.php
* WordPress core file modified: wp-includes/feed.php
* WordPress core file modified: wp-includes/formatting.php
* WordPress core file modified: wp-includes/functions.php
* WordPress core file modified: wp-includes/functions.wp-scripts.php
* WordPress core file modified: wp-includes/functions.wp-styles.php
* WordPress core file modified: wp-includes/general-template.php
* WordPress core file modified: wp-includes/http.php
* WordPress core file modified: wp-includes/js/tinymce/wp-mce-help.php
* WordPress core file modified: wp-includes/js/tinymce/wp-tinymce.php
* WordPress core file modified: wp-includes/kses.php
* WordPress core file modified: wp-includes/l10n.php
* WordPress core file modified: wp-includes/link-template.php
* WordPress core file modified: wp-includes/load.php
* WordPress core file modified: wp-includes/locale.php
* WordPress core file modified: wp-includes/media-template.php
* WordPress core file modified: wp-includes/media.php
* WordPress core file modified: wp-includes/meta.php
* WordPress core file modified: wp-includes/ms-blogs.php
* WordPress core file modified: wp-includes/ms-default-constants.php
* WordPress core file modified: wp-includes/ms-default-filters.php
* WordPress core file modified: wp-includes/ms-deprecated.php
* WordPress core file modified: wp-includes/ms-files.php
* WordPress core file modified: wp-includes/ms-functions.php
* WordPress core file modified: wp-includes/ms-load.php
* WordPress core file modified: wp-includes/ms-settings.php
* WordPress core file modified: wp-includes/nav-menu-template.php
* WordPress core file modified: wp-includes/nav-menu.php
* WordPress core file modified: wp-includes/option.php
* WordPress core file modified: wp-includes/pluggable-deprecated.php
* WordPress core file modified: wp-includes/plugin.php
* WordPress core file modified: wp-includes/pomo/entry.php
* WordPress core file modified: wp-includes/pomo/mo.php
* WordPress core file modified: wp-includes/pomo/po.php
* WordPress core file modified: wp-includes/pomo/streams.php
* WordPress core file modified: wp-includes/pomo/translations.php
* WordPress core file modified: wp-includes/post-formats.php
* WordPress core file modified: wp-includes/post-thumbnail-template.php
* WordPress core file modified: wp-includes/post.php
* WordPress core file modified: wp-includes/registration-functions.php
* WordPress core file modified: wp-includes/registration.php
* WordPress core file modified: wp-includes/revision.php
* WordPress core file modified: wp-includes/rewrite.php
* WordPress core file modified: wp-includes/rss-functions.php
* WordPress core file modified: wp-includes/rss.php
* WordPress core file modified: wp-includes/script-loader.php
* WordPress core file modified: wp-includes/shortcodes.php
* WordPress core file modified: wp-includes/taxonomy.php
* WordPress core file modified: wp-includes/template-loader.php
* WordPress core file modified: wp-includes/template.php
* WordPress core file modified: wp-includes/theme-compat/comments-popup.php
* WordPress core file modified: wp-includes/theme-compat/comments.php
* WordPress core file modified: wp-includes/theme-compat/footer.php
* WordPress core file modified: wp-includes/theme-compat/header.php
* WordPress core file modified: wp-includes/theme-compat/sidebar.php
* WordPress core file modified: wp-includes/theme.php
* WordPress core file modified: wp-includes/user.php
* WordPress core file modified: wp-includes/vars.php
* WordPress core file modified: wp-includes/widgets.php
* WordPress core file modified: wp-includes/wp-db.php
* WordPress core file modified: wp-includes/wp-diff.php
* WordPress core file modified: wp-links-opml.php
* WordPress core file modified: wp-load.php
* WordPress core file modified: wp-login.php
* WordPress core file modified: wp-mail.php
* WordPress core file modified: wp-settings.php
* WordPress core file modified: wp-signup.php
* WordPress core file modified: wp-trackback.php
* WordPress core file modified: xmlrpc.php

Hi,
in all my installations, when I log in, replace the header in all. php files … it happened today .. any advice,,,

I forgot to mention the animated gif banners. They have time animation frames. Of course, each banner different. Thank you

Excellent.
I further confirm that Wordfence is the best

Regards,
Miroslav

Hi, this is perfect. Thank you very much.