jooosh

I followed up with MT and below is their response. Totally makes sense and I’ll be taking their described steps to harden my sites. Here’s the main link they provided below:

GS:Improve your PHP security
https://wiki.mediatemple.net/w/GS:Improve_your_PHP_security

————
As a courtesy, I ran a scan on your (gs) Grid-Service to find and remove any known malware and payloads that our customers have been infected with recently. The results of this scan can be found in the mt_change.log file located in your home directory, as well as the changelog file located in data/mt_dbclean.

I definitely do see that the infection has spread across several domains as you’ve reported. However, this is most likely due to the infection gaining access to your (gs) Grid-Service through an out-of-date WordPress installation. Unless you enable open_basedir restrictions to secure PHP on your (gs) Grid-Service a bit further, it will be possible for these infections to spread across all domains. This is why you saw the infection on static HTML sites. That being said, enabling open_basedir restrictions would provide you with added security. This would essentially isolate your domains from each other, which would prevent the infection from spreading.

GS:Improve your PHP security
https://wiki.mediatemple.net/w/GS:Improve_your_PHP_security

The out-of-date WordPress installation that I’m seeing is for the domain xxxxxxx.com. You will want to update this, as well as other CMS installations that you have on your (gs) Grid-Service, to the latest version. Currently, the latest version of WordPress is 3.0.3. The latest releases, according to WordPress/Codex, are mandatory updates. This is due to the nature of the update, which was done as a security patch for exploits that were made known.

Please do keep in mind that we are happy to help you set up everything regarding our servers, and will often go the extra mile to help you set up third-party software to access our servers correctly; however, we are not responsible for the configuration or malfunctions of third-party software.

You may also consult the “Scope of Support” page for more details regarding the scope and amount of support covered by (mt) Media Temple for this and/or other specific products. Please visit the following URL for more information: https://www.mediatemple.net/go/sos/.

Let me know if there’s anything else I can answer for you regarding your (mt) Media Temple services.

Best regards,

@ipstenu: Thanks for following up with this post. I did eradicate some other malware but did not catch this one. Totally makes sense now as I suspected that there was still something else occurring on the site intermittently. I just didn’t know about this particular hack.

Curious if MediaTemple has a response to this.

Experiencing the same issues as well AND the site is on MediaTemple.

UPDATE TO MY COMMENT ABOVE:

After modifying my htaccess with the above entries, the admin tool was fast again, but I noticed that my main site was was actually slower and would almost hang on loading (especially after clearing my browser cache).

After further investigation (using tamper data in FireFox), the rewrite rule above was appending a forward slash to my image assets. This didn’t make sense as to why it was happening, and I even explicitly added another rule to ignore the images files, but a trailing slash was still appended.

This was causing my sites root index.php to be loaded for every image that was being called!

After no success modifying the htaccess to stop appending the trailing slash, I moved the file into the wp-admin directory.

After doing this, my admin tool continued to load quickly, and image assets loaded normally with no forward slash being appended.

Going to try this for awhile and if I see any other issues, I’ll post back here.

Hopefully this helps someone else.

Thanks to splivblaster!!! His confirmation of the .htaccess file contents totally fixed the slowness I’ve been experiencing with 2.7.1. My host is MediaTemple. I’m running: PHP Version 5.2.6, MySQL 4.1.25

Added the text below to my .htaccess and the site (https://ellawest.com) is as snappy as it was with 2.6.

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress