perezbox

Hi

Hard to give any advise without knowing the peculiars of what you have or haven’t done.

Thanks

Hi Brasofilo

Yes, a good portion of our team is made up of Brazilians.

As for the issue, let me get it to our dev team to see what they think about it.

Are you a client by chance? I just ask because if you are you’ll want to use the premium version, we’ll be updating this one in the coming months to be replaced by that.

Stay tuned.

Tony

Hi

Correct, its on your OS. The terminal on Windows is what you get when you run CMD from the start prompt.

But the real question is, are you running WordPress on a Windows box or is that where you spend your time. Most WP instances are on a LAMP stack which means it’s on some kind of NIX distro. What I mention above needs to be executed on the box that the site resides.

Thanks

GREP allows you to parse the content on your server by keying in for key words, phrases, patterns etc.. it’ll actually go through the files looking to see what it can find.

I wrote a post here that better explains what I was saying above: http://blog.sucuri.net/2012/06/understanding-conditional-malware-ip-centric-variation.html

As for not doing anything, sure unless something is referencing it. But then again, it could just be your .htaccess, who knows.. anyway..

And here is an article demonstrating the things you can do with grep: http://www.thegeekstuff.com/2009/03/15-practical-unix-grep-command-examples/

Cheers

Nami115

In terminal, try running this:

grep -RPn “(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|fopen|fclose|readfile|php_uname|eval) *\(” /var/www

Where /var/www is the directory path to your site. So if you download locally modify appropriately. This is not all encompassing but will give you a good idea of what is going on.

Please note, you might get a lot of false positives so you’ll want to go through each finding and verify what it reports. Working with backdoors is a bit of a bear, best of luck.

That last file, peosteve, sounds like conditional malware. Parsing traffic by IPs.

Cheers.

Hi

Don’t know i you still have this issue, but this is pretty common conditional malware – the condition is waiting for the Facebook referrer then redirecting.

redleg talks to eval(base64 etc.. type stuff which is one type, but you might also want to look for things like this.

Here is an example of what I mean: http://blog.sucuri.net/2012/06/understanding-conditional-malware-ip-centric-variation.html

Understand that this example is not often obfuscated.

Cheers

Hi Violaine12

Count20 can be a pretty persistent bugger. Here is something you want to try:

In terminal, try grepping for all count20.php instances:

grep -ri ‘count20.php’ .

The reason I say that is if you’re using an online scanner it might be pulling up the JS files, but more often than not you’ll find it in the index files as well. You want to be sure to remove all instances. Too often folks will remove the index instances or the JS instances, but not both.

The other thing you want to do is kill php execution in your uploads directory and wp-includes. You can try it in your theme directory, but some themes area bit finicky.

Also, I would take some time to go into your bluehost cpanel and download both your error and access logs – raw logs.

Not sure what all you have done, but seems that you might want to do some investigation to see what the source is, I’d be willing to bet its some kind of compromised credential.

Thanks

Hi

Tony here with Sucuri. Please if you ever feel we’re reporting something incorrectly send us a note at info@sucuri.net.

I’d be lying if I said we don’t make mistakes.

Take Care

Tony

Glad to see its better now. I do see that we’re blacklisting you in our own engine and I’ll pass it up to the engineers to take a look.