Title: java exploit hack in wp 3.3. beta Last modified: August 20, 2016 --- # java exploit hack in wp 3.3. beta * [SBfoto](https://wordpress.org/support/users/256studio/) * (@256studio) * [14 years, 7 months ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/) * I just got a java exploit error from my anti-virus and I cant log into my admin of my site. This is what my virus program called it. Exploit:Java/CVE-2010-0840. KM * [http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Exploit%3aJava%2fCVE-2010-0840.KM&threatid=2147649278](http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?name=Exploit%3aJava%2fCVE-2010-0840.KM&threatid=2147649278) * The exploit start at line 127 of the wp-admin/admin-header.php file * ``` if ( $parent_file == 'options-general.php' ) require(ABSPATH . 'wp-admin/options-head.php'); ``` Viewing 13 replies - 16 through 28 (of 28 total) [←](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/?output_format=md) [1](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/?output_format=md) 2 * [ktaylor](https://wordpress.org/support/users/ktaylor/) * (@ktaylor) * [14 years, 7 months ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347690) * Hi all, We have this issue on our website also. We have gone through deleting the code from the php files, but I have not touched the cache. Can I just delete the cache in the themes folder or do I have to do something else? Is there anything else I need to look for? THANKS!! Kaz * [alnmco](https://wordpress.org/support/users/alnmco/) * (@alnmco) * [14 years, 6 months ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347693) * I first got this on Oct 20 though I’m just noticing it today after finding a long suspicious code …((!isset($eva1fYlbakBcVSir) in my header, footer, and index file. Throughout the week users were reporting that there antivirus blocked my site because of a trojan. * FYI – I’m completely up to date with wordpress and am using 3.2.1. * I’ve deleted all of the malicious code and am in the process of securing things better. * [mjjones](https://wordpress.org/support/users/mjjones/) * (@mjjones) * [14 years, 2 months ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347778) * Found this !isset bit today again even in Twentyten and TwentyEleven themes which I had never used. But my Contact 7 is clean. And I got in on 2 sites which didn’t have Contact 7. And my sites had the latest WP and all plugins updated. So there must be various entrances. * [ravage](https://wordpress.org/support/users/ravage/) * (@ravage) * [14 years, 2 months ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347781) * I have been fighting this for about a year on installs at work. I traced it back to an occurrence in 2008 on one of the sites. A false user had been injected into the database. But the real source of the constant re- infection seemed to be….. “Hello Dolly”. Even though the plugin was inactive. once I found the code inside of it and removed it- the attacks stopped (fingers crossed) it has been 2 months sine I had to remove the crap from my indexes, headers, and footers- so I hope that was it. I did, of curse remove the hidden user- but I did get hit again after that. I had to comb through basically ever .php file to find it. Of course it’s possible that this exploit wears many masks- but if it happens- check you’re hellow dolly- since it’s in every install- it’s a really good target. * Thread Starter [SBfoto](https://wordpress.org/support/users/256studio/) * (@256studio) * [14 years, 2 months ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347782) * First thing I do is delete the hello Dolly plugin once I install Wp. * [Chip Bennett](https://wordpress.org/support/users/chipbennett/) * (@chipbennett) * [14 years, 2 months ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347783) * The Hello Dolly Plugin was _infected_ on your install, but it was not the _source_ of the exploit. There’s nothing in Hello Dolly even to _be_ exploited, AFAIK. It just hooks some text strings into a hook in the admin header. * [tekno23](https://wordpress.org/support/users/tekno23/) * (@tekno23) * [14 years, 1 month ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347796) * Just FYI, I found a partly-written cleanup PERL substitution, which runs much quicker than the PHP, and is useful for anybody who has shell access to their installation. * I fixed the quoted strings issues and turned it into a shellscript using a simple‘ find’ to get the files to clean, which I’ve put onto pastebin here – [http://pastebin.com/8vvWpFR8](http://pastebin.com/8vvWpFR8) * [Gustavo Lanzas](https://wordpress.org/support/users/audioel/) * (@audioel) * [14 years, 1 month ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347797) * Tekno23 – thank you so much for doing that! Worked great, and I had a LOT of sites to run it on. * Does anyone have any idea how this code is getting injected in? * [Paweł Knapek](https://wordpress.org/support/users/adpawl/) * (@adpawl) * [14 years, 1 month ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347798) * [@audioel](https://wordpress.org/support/users/audioel/), check this in your server logs * [daviddevor](https://wordpress.org/support/users/daviddevor/) * (@daviddevor) * [14 years ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347800) * [@tekno23](https://wordpress.org/support/users/tekno23/) Man you rock. My work has a VPS with over 50 wordpress installs and most of them were infected that perl script saved my life and at least a days worth of work. AWESOME! * [AuthGirl](https://wordpress.org/support/users/hyky314/) * (@hyky314) * [14 years ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347801) * [@tekno23](https://wordpress.org/support/users/tekno23/), [@audioel](https://wordpress.org/support/users/audioel/), [@daviddevor](https://wordpress.org/support/users/daviddevor/) Please guide me how to use this ‘Bash/Perl fix for “eva1fYlbakBcVSir” WP Backdoor/Malware’ code. * I’m using VPS as well. ever since I changed to VPS I’ve been getting this infection on my sites. I was able to find which files got infected and replaced with original files, but they were keep coming back with backdoors which is unable to find.. * Sounds like [http://pastebin.com/8vvWpFR8](http://pastebin.com/8vvWpFR8) by tekno23 is the alternative way to prevent the infection. But I have no idea how to use this though… 🙁 * On my cPanel, I’ve just created a new key for SSH and made it authorized (SSH/ Shell Access). and clicked ‘Perl Modules’, ([page looks like this](http://draft001.function2.com/screenshot_35.jpg))…. now my head turned to black…. [@_](https://wordpress.org/support/users/_/)@ * I’ll be so appreciated if someone can give any tip how to use this. Thanks and best regards. * [daviddevor](https://wordpress.org/support/users/daviddevor/) * (@daviddevor) * [14 years ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347802) * [@hyky314](https://wordpress.org/support/users/hyky314/) * You need to run this script after you log in with ssh and have the command prompt. * This will not prevent future attacks, it just helps in removing all segments of the code from your files. Look at the thrid post from Jan talking about securing your site from future attacks. If your files are already cleared out than you need to take a look at those links and make sure you dont have security issues with your plugins or .htaccess files. Also check your mySQL users and make sure you recognize all of them. This can be another culprit for malware. * Hope this helps. * [taloweb](https://wordpress.org/support/users/taloweb/) * (@taloweb) * [13 years, 11 months ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347823) * I used a .php file to find infected files and fix it…but I would like to know if the malware entered through a security breach on the server or on WP… Viewing 13 replies - 16 through 28 (of 28 total) [←](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/?output_format=md) [1](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/?output_format=md) 2 The topic ‘java exploit hack in wp 3.3. beta’ is closed to new replies. * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) * 28 replies * 17 participants * Last reply from: [taloweb](https://wordpress.org/support/users/taloweb/) * Last activity: [13 years, 11 months ago](https://wordpress.org/support/topic/java-exploit-hack-in-wp-33-beta/page/2/#post-2347823) * Status: not resolved ## Topics ### Topics with no replies ### Non-support topics ### Resolved topics ### Unresolved topics ### All topics