Weird visitorTracker code suddenly on my site

Hi All

We just published an article updating some information pertaining to this infection and the trends we’re seeing:

https://blog.sucuri.net/2015/09/wordpress-malware-active-visitortracker-campaign.html

Im having the same malware issue (visitor Tracker) – where can I find the exact code to remove from the infected files?

@ summitwynds

where can I find the exact code to remove from the infected files?

It’s probably better to restore from your most recent backup.

The infection seems to be happening through FTP. You can block VisitorTracker uploads using upload time scanning. This is a case study of this malware affecting a Joomla site. It is equally applicable to WordPress sites.

https://bobcares.com/blog/how-active-visitortracker-campaign-malware-spreads-and-how-to-block-it/

I have restroed and also removed the infection 2-3 times now, but still this keeps coming, can anyone suggest some permanent solution to this issue.??

Same issue as the poster above. I’ve removed the infection a few times now but it just keeps coming back after a few days.

Hi All

Here is an update to the latest trend: https://blog.sucuri.net/2015/09/wordpress-malware-visitortracker-campaign-update.html

Thanks

All plugins have been updated and it still seems to get on the website somehow. I’ve even made the plugins folder readable and executable only (not writable), and it gets through.

Interestingly enough, I cannot even tell which files have been modified by the dates anymore – the “Date” remains unchanged.

@fshbrsh

have you installed ithemes security plugin?

The easiest way I can tell now when the files are modified is that the permissions change to 0655 instead of 0644