Malware & Wordpress

[NileCruises]

Google has identified Malware on on eof our Wordpress sites. In webmaster tools it names the 10 pages where code has been injected.

I cant' find them easily via the WP dashboard and wondered if anyone had had any experience of this and what steps they took?

Plus are there any measure I can take to fight against this? The site is on the latest WP version.

Thanks,

Colin

[MarieHaynes]

Definitely keep your plugins updated.  Plus, if you use Timthumb on any of your sites, do some research on Timthumb vulnerabilities.

Make sure you change all of your wordpress passwords after cleaning up.

And, if you get hit again, despite your cleanup, hire a professional!  I had a nasty job done on one of my sites.  My host thought they'd fixed it and it came back.  I hired sucuri.net to fix it and after 3 weeks they were no further ahead.  I hired a professional guy (pm me for the name if you want to hire him) and it took him a while but he figured it out.  Not all malware issues are that complicated though.

[evolvingSEO]

Colin

Any luck with this yet? I'd follow Marie's good advise and first be sure everything is updated. Then try these things to find it;

• Disable each plugin one by one and see if it goes away.
• Can you see the code when you view source or use a tools like browseo.net or shut off CSS? If you can see the location of the injected code you may be able to tell where it was inserted.
• If you can't see it viewing source or with browseo etc - try doing a Google cache: search and view in text only.
• Check your widgets.
• Check your .htaccess file

Once you find it definitely check out this document on securing wordpress.

Let us know how it goes.

-Dan

[mhadaily]

That would be ok if you use these plugin as well :

http://wordpress.org/extend/plugins/sucuri-scanner/

http://wordpress.org/extend/plugins/gotmls/

http://wpantivirus.com/

[NileCruises]

Thanks Marie (and Dan and Majid),

I am going through the plugins and widgets now. I re-installed a clean version of the Theme too but not sure if I've done that too soon if the script is still there.

I can see the page titles in Webmaster Tools but cant' find the actual pages on the server to delete, in case that helps.

I will definitely look at the security suggestions and resources suggested. Thanks for the tips.

Marie I will PM you too if I may.

Thanks guys,

Colin

[NileCruises]

Thanks Majid,

Sucuri Scanner looks good. I wonder if you had any experience of it?

If it can remove the malware as well as alerting me of any future hacks it would seem money well-spent.

Colin