I recently noticed that the following hidden links were added to the bottom of some web pages of one of my website:
Searching from where this code was generated, I noticed that the following piece of code was included at the top of almost every php files of my website:
Browsing some websites, I have found that some other webmasters had the same problem on their sites. Here is the best description of the symptoms related to this malware:
http://www.marinbezhanov.com/web-development/6/malware-alert-september-2011-sshell-v.1.0/
and here is a php script that was developed by PHP Beginners to clean up all the infected pages (http://www.php-beginners.com/solve-wordpress-malware-script-attack-fix.html).
If you found the malware in your sites, copy the cleaner.php to the root of each of your websites and run it with (http://mysite.com/myinfectedsite/cleaner.php).
You should as well find and delete the following files if they exist on your server:
wp-thumb-creator.php
b7a.php
a95b.php
Hoping that this will make the full cleanup, last but not least it is strongly advised to change all your passwords (sites, database and FTP).
I suspect that this malware is coming from on of the wordpress plugin but cannot confirm it for the moment. I will keep you posted when I find the patient zero.
Good luck!
VN:F [1.9.22_1171]
Rating: 5.0/5 (2 votes cast)