jbekker
Forum Replies Created
-
Forum: Fixing WordPress
In reply to: XML parsing errorI was also using Filezilla. And filezilla save your passwords in clear text.
So after changing all passwords i did not save them anymore in Filzilla
Forum: Fixing WordPress
In reply to: XML parsing error@useshots I looked for .(dot) directories but did not found any.
I Changed all FTP passwords right after discovery of the breach…
So this might have helped preventing the next step in the attackI checked the FTP logs and all index.php and index.html files where uploade using FTP from IP 46.252.130.109
Forum: Fixing WordPress
In reply to: XML parsing error@useshots I blamed the Kryptik because the outbreak occurred after the virus warning popped up on the laptop.
Forum: Fixing WordPress
In reply to: XML parsing errormaby they use the injection to check if the site is monitored and only infect sites that call back for a while…
Forum: Fixing WordPress
In reply to: XML parsing errorSven, you’re right its not a WP bug of hole but the initial attack comes from a Trojan on your PC…
After getting you FTP data it changes the index.php and index.html files on the FTP servers…
Did not know about the second step. Fortunately i changed all FTP passwords..
Forum: Fixing WordPress
In reply to: XML parsing error“So it looks like virus scans all night and then checking the other sites.”
REMEMBER: its NOT wordpress that got hacked but YOUR PC- Make sure:
- that the virus is removed from your PC
- you change ALL ftp passwords on the sites you used
- just over write all files with tha latest word press
- Check if there are more lines on your server
//find all string imgaaa.net in all subdirs
grep -lr imgaaa.net . > bad.txtForum: Fixing WordPress
In reply to: XML parsing errorYou or someone who also uses your FTP data had got a trojan –> win32/kryptik
This trojan sents all your FTP data and passwords to someone who than uses it to change all index.html and index.php files on your server and adds to the end a string like <img heigth=”1″ width=”1″ border=”0″ src=”http://imgaaa.net/t.php?id=6744753″>
the number at the end changes on every file…I had it today for a few customers on Joomla sites
John Bekker
SJL Creations