safaristyle
Regular Member
- May 4, 2008
- 453
- 82
Did anyone face this JS/Kryptik.RW trojan while visiting wordpress site. My sites are currrently affected with this trojan. Every single time I am getting notification (i am using eset smartsecuity)
JS/Kryptik.RW trojan in Wordpress Site
- Thread starter safaristyle
- Start date
safaristyle
Regular Member
- May 4, 2008
- 453
- 82
No my wordpress installs are up to date
portalweb
Supreme Member
- Jan 7, 2010
- 1,435
- 579
2 possible reasons:
1) Bad/infected "free" theme with encrypted php code in footer
2) Scrupulous plugin that inject trojans/malware on client's side.
Solution: Fix your site by replacing "free" themes with "premium" from reputable sites, as well as the plugins too. If you are not sure, please PM or IM me - I'll be able to help, as I did for others.
Probably an SQL Injection, you need to make sure your WP installation is up to date and your not using any plugins that have recently been addressed as vulnerable to an SQL injection attack. You can actually check which of the latest scripts and plugins are vulnerable over at http://1337day.com/webapps. Never thought of actually using SQL injection as a method of getting back links, takes blackhat to a whole new level then doesn't it lol. There must be hundreds of high PR sites out there that are vulnerable, easy pickings or down and out shady tactics??? hmm
safaristyle
Regular Member
- May 4, 2008
- 453
- 82
Guys All my sites got hacked with "eval(base64_decode" please tell me what to do
You have been told here already. You need to secure your installation by upgrading to the current, latest stable version of wordpress. Then it will just be a case of removing the base64 encoded links from the footer. You may also want to check that there isn't any web shells left behind by who ever did this to you. Id run a rootkit scanner too if it's a dedicated server, if it's shared hosting, speak to you hosting company and make them aware of that has happened.
