matts3008

up 2

Of course Andrew. After we did the steps above, we went and install a bunch of security featured plugins to help prevent intrusions and other stuff ??

Hey all. Just spent a couple hours tracking this malware down. We are still on 4.3 but just like the rest of you, the injection starts from a common_configs file that some how got injected in our site (specifically in wp-includes/theme-compat/common_configs.php) This file then inject visitortracker to the header and footer as well as any JS file it can find refernce to on the index page.

So thankfully only 37 JS files got infected. I have a nice little find and replace tool I use that you can download here: https://findandreplace.codeplex.com

Believe me it will save you a lot of time ?? Just first:

-search for visitortracker and make sure you have ** in the File Mask
– you will then see some php and JS results.
– Simply double click one of the files, copy code from visitortracker all the way until you see it commented out again.
– IMPORTANT be sure not to copy the ending /*. this script was smart enough to inject itself right before leading comment command in the JS file
– Once you have copied the code, the paste it in the Search field in the FNR app.
– for replace i just did /**/ to avoid any whitespace errors

Hope it helps you all out ??

P.S. also don’t forget to search your server and remove any file named common_configs

Like the plugin. Question, is there an override feature to adjust this so I done have to re-create the embed? So I can adjust it in the url

I totally bypassed the .htaccess file route. Luckily my client was with Godaddy and they instructed me how to make my own php.ini file, even on shared hosting. You just got to create a “.user.ini” in the root if you are using Cpanel, if not on Cpanel then name it “php5.ini”

Then plugin this to that file and you good to go!

suhosin.post.max_array_index_length = 256
suhosin.post.max_totalname_length = 65535
suhosin.post.max_vars = 1024
suhosin.request.max_array_index_length = 256
suhosin.request.max_totalname_length = 65535
suhosin.request.max_vars = 1024

max_input_vars = 2000

change the variables as needed.