Wordpress Zero Day

So If I have this right, all I need to do if I find this file is delete it? Do I have to reload the patch or can it just be deleted and manuelly resize any images I us on my site? :06:

Use your cPanel --> File manager and do the search. This will find all instances. Then if you're still suspicious do a manual search using your FTP program >>>

OR, press the HOME icon to use all folders and sub-folders... (the box will now not show any folder name in it). Then...

Search >>





.

i found it in the content/plugins..is it also?

Id say if you found it anywhere follow the instructions

Anyone have a problem with the guy still having access after you delete the
timthumb.php file, change your passwords and restore .htaccess?

My sites all got their .htaccess played with and all search engine traffic on my
sites are being redirected. I believe the person got in through the timthumb
file as I found it on one of my sites in the server, but I have since deleted the
file and changed all my passwords to very long complicated ones and he still
has access. Every time I change my .htaccess back, his bot just changes
them again, seems to be on an hourly basis. I believe he has just put a (or
many) .php file in my server somewhere and that is allowing him access now
since I have deleted the timthumb. Having my hosting guys and my tech guy
look around but havn't found anything yet.

Anybody have the same problem?

EDIT: found the php shell he was using and deleted it.

so if I have thumb.php do I replace it with the same code as given in the link for timthumb? How can I tell if my site has been compromised? Sorry for the newbie questions.

mandom said:

so if I have thumb.php do I replace it with the same code as given in the link for timthumb? How can I tell if my site has been compromised? Sorry for the newbie questions.

Click to expand...

That's what I did - thumb.php looked like timthumb.php, I'd rather have a theme that doesn't work than malware on my site... You can check if your website is infected by checking your source code - one of my affected websites had a javascript injected after the </body> tag with a link to superpuperdomain.c0m. All affected websites had .htaccess file messed up with redirections to some domains with .ru (russian) TLD - 100% dodgy. Also, whoever did this is usually leaving backdoors like udp.php upd.php - make sure you look for small php scripts with recently modified timestamps - when you open them you will see more links to .ru websites... Royal pain in the ass - if you have a timthumb.php or thumb.php you can pretty much guarantee that you will be infected sooner or later (if you have not been attacked already). My own websites hosted on three different servers have all been affected - even my mate hosting his websites in South Africa had the code injected and .htaccess messed up with...