Weblogtoolscollection News » Help and Support

How to prevent viruses uploaded to wp -blog -header.php?

  • Topic started 5 years ago
  • 3 posts so far
  • Latest reply from gestroud

  1. gestroud
    Administrator

    I've recently noticed that someone has uploaded a virus - JS/Downloader Agent to a number of my WP 2.51 web sites.

    Whoever the attacker is uploads it to wp-blog-header.php.

    The file is originally 2KB. The new file is 3KB.

    I have already contacted my webhost (Servage) and installed a fresh copy of WordPress.

    Read/Write permissions are set to 755 on the root folders.

    No one has my passwords, but I've just changed them, just in case.

    I have wp-ban installed, as well as wp-blockadmin and the Login Error Cleaner plugin.

    All plugins are up to date.

    What I'm trying to figure out is how to prevent it from happening again.

    Any suggestions?

    Posted: 5 years #

  2. donchenko
    Member

    Maybe its a virus on your computer.

    Here is description one of them http://www.viruslist.com/en/viruses/encyclopedia?virusid=147349

    This virus steal passwords from many soft and can use them to upload virus code into your sites.

    Check your computer with antivirus, and try to change all password, FTP password, Hosting-admin password etc.

    Posted: 5 years #

  3. gestroud
    Administrator

    Thanks for the link, donchenko. I appreciate it.

    Luckily, the virus isn't on my hard drive. It's definitely something someone uploaded to the web host's server. Twelve different sites - with twelve different passwords - were affected. The only thing they have in common is that they are all on the same server - that and the fact that they were hacked. :-S

    Right now, I'm looking for every resource available to make it as difficult as possible for my sites to be hacked again. And I'm also sharing the info that someone is targeting wp-blog-header.php files for attacks.

    Posted: 5 years #

RSS feed for this thread

This topic has been closed to new replies.


Back to top

0.056 - 12 queries