Warning! Spam hack - virustotal undetected!

[jessica7689]

For those who are not aware..

Please Be Careful When Downloading Wordpress Themes from Nulled Sites.

There is a malicious code that is undetectable by virustotal. It hacks your meta/keyword description.

The code for this hack is hidden in an "image" file typically a .png or .jpg located in wp theme folder. Most common experiences (images/social.png). You can verify this using a text editor.

Please kill this image immediately. You can also navigate to your functions.php file and remove malicious code
(<?php include('images/social.png'); ?>)

This sneaky little bastard can be found on files from popular sites like nulledphp, theme123.net, etc.

 

[asap1]

Good looking out and thanks for the warning

 

[Kaleesi]

Can Wordpress security plugins like Wordfence prevent these malicious code injections?

 

[jessica7689]

Can Wordpress security plugins like Wordfence prevent these malicious code injections?

nope! Well it didnt for me.

 

[AmateRasu]

nope! Well it didnt for me.

the no external links WP plugin will help

edit : don't forget to check your wordpress files if it contains Base64 codes

 

[donkeytherune]

damn even those have virus !

 

[stacy666]

I never did that before, but I tried what you said and didn't find anything. I'm clean I guess..

 

[TheUnborn]

Thanks for letting us know

 

[verilix]

Thanks for the heads up. This is why I pay for my themes, ahhaha.

 

[Panther28]

thanks Jess, Null themes are bad idea, there are a ton of other ways to hide those little nipper scripts.

 

[jessica7689]

Not to scare you guys but see:

http://stackoverflow.com/questions/23318954/wordpress-hacking-via-false-png-images

" This is what happens when you are using nulled themes... Actually the social.png is a php script which finds all records in servers database table and sends them to a specific host, so they can access your server."

so be careful.

 

[The Scarlet Pimp]

there are online base64 decoders, learn to use them before you run that theme! also watch out for "packer" code in the wp themes.
(woo themes often have packer code)

see below:

http://www.blackhatworld.com/blackh...s/685993-how-decode-packed-j-script-code.html

 

[Oukast]

Is there such thing as clean and nulled file?

 

[Clifton Allen Says]

Is there such thing as clean and nulled file?

yes, its called buying a retail version

 

[Numbuh362]

I always paid for my themes because I always felt that the person uploading the cracked theme would be able to hack your wp.

 

[juniorsand]

Good looking out thanks