Admin – Search Plugin page – hacked/exploited

If they exist, they’ll be in your theme’s directory:

wp-content/themes/your-theme-name

Ah, found it. It was not on my main domain, but I found it on one of the subdomains. Hopefully deleting those will do the trick. Crossing my fingers.

Thanks Psynix.

Another suggestion is that after you’ve uploaded a new corrected .htaccess to make in only readable by changing it back to 444 so that no malicious script can over write it again.

Just remember what you’ve done in case you change your permalink settings, or do anything that requires editing of your .htaccess, because nothing will be able to edit it while it’s 444. Example: plugins like WP Super Cache.

Thanks MickeyRoush — good suggestion.

1 hour and it hasn’t changed yet. If I see it crop up again I will definitely fix and change to 444.

Hey guys,

Is the actual file names “thumb.php” vulnerable? I am fully aware of the whole “timthumb.php” issue, but I just scanned my themes today and found that in one of them, it is using just “thumb.php” and wondering if it’s at risk.

If it is, how can I secure it with “timthumb.php”? (Especially since the filename does not match).

@ rezwalker666 They are the same files … just remove the old ‘thumb.php’ and rename the new ‘timthumb.php’ to ‘thumb.php’.

Cool beans, it worked just fine psynix. Thank you mate ??

I think that this issue with timthumb.php is the biggest in wordpress history!!!

You should check these out also.

https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/
https://codex.www.ads-software.com/Hardening_WordPress

Thanks everyone for their help here which has helped me fix my hacked site from this horrible problem – much appreciated!

Hi,
similar problem here, the following files have been uploaded somehow to our servers theme directory:
sm3.php
d.php
r1.php

One file has 3 domains in it (the “NOT safe for work” type).

We did not see redirects yet, but someone apparently is sending mail via our server (we got the bounced ones back – that’s how we noticed).

We will fix it now, bu t can anyone point out how the files got uploaded? does someone know the passwords for the ftp or root access?

Thanks

I had some issues with the TimThumb.php exploit on multiple sites. I spent a good amount of the last week reading about how to beef up security and do a better job on my part to not let it happen again.

Here’s a couple links that definitely were helpful:

Check your site for malicious files and content (it will show you the direct path to evil files or files that have been compromised): https://sitecheck.sucuri.net/scanner/

https://www.tipsandtricks-hq.com/cool-wordpress-htaccess-tips-to-boost-your-wordpress-sites-security-1676
https://codex.www.ads-software.com/Hardening_WordPress
https://codex.www.ads-software.com/Changing_File_Permissions
https://techspheria.com/2011/08/phpremoteview-hack-what-it-is-and-how-to-remove-it/

This guy rewrote TimThumb this last week, many thanks to him. Lots of good articles about this situation and others on his site:
https://markmaunder.com/

New TimThumb:
https://code.google.com/p/timthumb/

psynix I really need help with this I cant seem to get it right. Can you please help me here is my email [email protected].