The attack from the .cc’s domains

8 comments

1. Thanks for posting the information.

   I’m seeing several sites with this same issue. I found a couple nasty trojan horse backdoor executable programs inside various wordpress plugin folders. Example: wp-content/plugins/XML-sitemap/XML-sitemap.exe. It seems that this malware is generating .exe (backdoors) using directory names. Yikes!

2. Thanks for posting this…I have had this attack on EVERY single site of mine….the problem Im seeing though is that even after deleting the code in about an hour it comes back to every site! I was simply replacing the index.php with a clean one from a clean wordpress install.
   I will now go look at my plugins as Regina says there are some backdoors apparently

3. I can’t seem to find the backdoor (searched for .exe , .old , .bak files ; also searched plugins folders and uploads folders). Once I clean the files in several hours it gets back. It only infects index.php and index.html, basically all index files. Anyone found the form of the backdoor so far?
   I’ve changed the passwords and it doesn’t seem to be modified via ftp since the modification date of the index.php files remains the same old one even after infection. It must be a wordpress hack .
   Thx

4. I have not found it either. If you have multiple sites on one server make sure it didnt infect another site as the host and then spread across your servers sites. Im thinking it could be somewhere in mysql. What I am planning on doing tonight is setup a brand new subdoain and put a brand new clean wordpress on it and nothing else and make sure not to visit it at all and then monitor the source code and once it updates with the malware go and look at the logs and look at alll the files and try and see if i can find anything in log and any other files that were modified or messed with. Part of the problem I am having is the sites I have on my server all all developed sites…so there is content all over the database and in the directories…so its hard to know whats “wrong” and whats still legit…so hopefully this clean test site i “hope” gets infected will help narrow it down

5. This virus is way too good,I’ve pulled my hair out but I can’t give up. Going to disable the sites one by one and see which ones have the backdoor. If the virus doesnt get back then it means that’s the site with the backdoor. Have u noticed any pattern in making it get back? Seems to get back every 2-3 hours after I remove it.

6. I just had the same thing happen to my sites. All of my WORDPRESS sites have the cc url’s with the iframe/eval/base64 code in the index.php. I find it crazy to believe that one older version of wordpress would allow access to my server and other directories. Is this what happened? Some non wordpress sites also have the iframe hack in them, while others do not. How do I clean it out? I’m considering just moving some over to another new fresh server. I think deleting everything is the way to go.

7. Pingback: Silly Wordpress, you have holes in you! – Ramblings of Narc
8. Pingback: Google blocks .co.cc, attackers are now using .co.tv « -= Jarvis =-

Comments are closed.