Magic jili download,Jili 9999 login app.REGISTER NOW GET FREE 888 PESOS REWARDS!

Resolved roadster59
(@roadster59)

10 years, 2 months ago
Hi
it seems there are somme attack since 2 or 3days on the last wordpress

they change 2 files
tamplate-loader.php
at the begin insert this

[ Moderator note: code fixed. Please wrap code in the backtick character or use the code button. ]
```
function FuncQueueObject()
{
	wp_enqueue_script('swfobject');
}
add_action('wp_enqueue_scripts', 'FuncQueueObject');
```
an the other file is swfobject.js

and they insert
```
eval(decodeURIComponent('etc...
```
my wordpress is with the last plugin and the last wordpress and every things ok

somebody nows what happends
best regards
eric

Viewing 11 replies - 1 through 11 (of 11 total)

Amin – WPMU DEV Support
(@wpmudev-support2)

10 years, 2 months ago

Hello roadster59,

Give this article a read to make sure your site is indeed hacked: https://www.chriswiegman.com/2013/06/how-to-tell-if-your-site-has-been-hacked/

Best Regards,
Calvin

Moderator Jan Dembowski
(@jdembowski)

Forum Moderator and Brute Squad

10 years, 2 months ago

You need to start working your way through these resources:
https://codex.www.ads-software.com/FAQ_My_site_was_hacked
https://www.ads-software.com/support/topic/268083#post-1065779
https://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
https://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
Hardening WordPress
https://sitecheck.sucuri.net/scanner/
https://www.unmaskparasites.com/
https://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html
https://blog.sucuri.net/2010/07/understanding-and-cleaning-the-pharma-hack-on-wordpress.html

Mike Stott
(@mikemayhem3030)

10 years, 2 months ago

Hey all, not sure where my other reply went, but the same issue has affected my sites too (all of them, not just one of them)

Moderator Jan Dembowski
(@jdembowski)

Forum Moderator and Brute Squad

10 years, 2 months ago

@mikemayhem3030 If you need support for your site then per the forum welcome please start your own topic.

https://www.ads-software.com/support/forum/how-to-and-troubleshooting#postform

Or if you’d like to assist the original poster with his problem in this topic then that’s cool. ??

If you’re hacked then the answer will be the same and you will need to delouse your site. If you have any questions about your problem then feel free to ask in your topic.

Mike Stott
(@mikemayhem3030)

10 years, 2 months ago

I was just adding more credence to the OP – in that it may be an issue with WP 4.01 where would we go about reporting this issue?

I’ve had the same situation as the OP, running the latest version, plugins up to date – but will continue to investigate to see how the attacker got into ALL the installs I run

The exact same files have been modified in the same way on my own sites as the OP. template_loader.php modified to include /js/swf_object.js which has been compromised.

Following the above links now but interested to find out if anyone else has the same issue

Moderator Jan Dembowski
(@jdembowski)

Forum Moderator and Brute Squad

10 years, 2 months ago

I was just adding more credence to the OP

He was hacked. No doubt about it.

*Drinks more coffee*

In a perfect world, all hosts would follow good security practices, no one would used shared hosting (it would not even exist), all accounts on a host would be via isolated VPS with isolated filesystems.

And after that I’d pronounce that “I WANT A PONY!” ??

Sites get hacked usually due to insecure hosts, shared hosting where someone installed The Very Bad Thing? (nulled themes are my current favorite) or an add on was exploited.

None of that means 4.0.1 has a vulnerability that is being exploited. It does mean that your site and the OP have been hacked and delousing your install is going to be a long and tedious process.

Mike Stott
(@mikemayhem3030)

10 years, 2 months ago

OP – further to this thread, if you run more than one site you may wish to check out

https://wpremote.com

Hope this helps, I’ve cleaned the above files now and will be interesting to locate how this happened – I’ll let you know what I find out

Thread Starter roadster59
(@roadster59)

10 years, 2 months ago

Hi Mikemaythem

i have several wordpress on a host
and they are all hacked

and right now a mail of google to say
“[Outils?pour?les?webmasters] Détection d’une infection par un logiciel malveillant?“
a malware are one the web site
??

barnez
(@pidengmor)

10 years, 2 months ago

Check this post: https://www.ads-software.com/support/topic/all-my-sites-6-hacked-with-soaksoakru?replies=67

Sounds like your issue is related to the Slider Revolution/Showbiz Pro shell upload exploit

Thread Starter roadster59
(@roadster59)

10 years, 2 months ago

thanks Barnez
??

Amin – WPMU DEV Support
(@wpmudev-support2)

10 years, 2 months ago

Check this out guys: https://blog.sucuri.net/2014/12/soaksoak-malware-compromises-100000-wordpress-websites.html

Please tell it to your friend who use wordpress as their CMS.

Best Regards,
Calvin