Malware gefunden - Was jetzt machen?

Yakuza · 15. September 2011

Ich hab meine Seite durch einen Scanner laufen lassen (keine Ahnung wie vertrauenswürdig die sind)

Scanner -> http://sitecheck.sucuri.net/scanner/

Was gefunden wurde:
http://sucuri.net/malware/malware-entry-mwjs2368

A malicious and encoded javascript file was found inside the site content and is being used to distribute malware (from newportalse.com and other domains). Any user visiting the infected site could be compromised (desktop antivirus will flag it as JS:Cruzer-B, JS/Obfuscated, JS/Cruzer.C.gen, JS/TrojanDownloader.Agent.NKW and others, depending on the intermediary domains and AV product).
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

Was kann ich jetzt tun?

bgeissler · 15. September 2011

google mal nach: MW:JS:2368
Vielleicht findest du was dazu.

Yakuza · 15. September 2011

Was ich jetzt mal kurz gefunden habe:

[update]
seemed to have clean the install and no more problems. here are the steps I took:
1. download wordpress and extract l10n.js listed above, and replace it, there is malicious code in it.
2. clean your functions.php file in your themes, some versions of this might affect more than one install or theme, mine happened to just be in active theme. they inject about 100 lines then add some code.
the code:
http://pastebin.com/Qe1Ag47A
thats what you want to delete. also redo your salt tags.
3. make new username/password for wordpress and database.
http://sitecheck.sucuri.net/scanner/ posts that there is no more problems. this was scary as I have about a million hits a month, yikes, hope I didn't do damage to other peoples computers :/
note: this might not be an exhaustive method, there more be more hidden code. my wordpress was updated to most current version and all plugins were updated, so I'm not sure how it happened.
so far no more problems. hope this helps.

You should also check your .htaccess and wp-config.php
Klicke in dieses Feld, um es in vollständiger Größe anzuzeigen.

http://www.mynakedgirlfriend.de/malware-in-wordpress-blogs-bereinigen/

Michi91 · 15. September 2011

verwendet dein wordpres timthumb? hatte nun schon 2 Kunden deren WP mit Malware durch eine Timthumb Sicherheitslücke verseucht wurde.

Yakuza · 15. September 2011

Ja, hatte es. Aber ich meinte die Sicherheitslücke geschlossen zu haben (durch ein Template Update), aber ich vielleicht hab ich aber die entsprechende Datei vergessen zu löschen. Wo wäre die abgelegt?

Yakuza · 3. November 2011

Keine Malware dieses Mal, aber wieder ein "verdächtiges Trojan.Script.Iframer" das nervt. Was kann kann ich dagegen tun?

WPDE.org

Malware gefunden - Was jetzt machen?

Yakuza Well-Known Member

bgeissler Well-Known Member

Yakuza Well-Known Member

Michi91 Well-Known Member

Yakuza Well-Known Member

Yakuza Well-Known Member

Nützliche Suchen

Malware gefunden - Was jetzt machen?

Yakuza Well-Known Member

bgeissler Well-Known Member

Yakuza Well-Known Member

Michi91 Well-Known Member

Yakuza Well-Known Member

Yakuza Well-Known Member