perezbox

Hi Nick

The fix should be pushed now.

Thanks for bringing it to our attention.

Tony

Hi All

We just published an article updating some information pertaining to this infection and the trends we’re seeing:

https://blog.sucuri.net/2015/09/wordpress-malware-active-visitortracker-campaign.html

Hi David

Where do you feel you were cheated? From what the documentation offers, how did the plugin not do what it said it would?

I look forward to your thoughts on why we are a sleazy and deceptive vendor.

Thanks

Hi

You’re dealing with similar issue to another person, whom was dealing with Casino injections. Very similar issue.

Here are a few articles that might help:

1 – http://blog.sucuri.net/2014/11/combat-blackhat-seo-infections-with-seo-insights.html

2 – http://blog.sucuri.net/2013/02/payday-loan-spam-affecting-thousands-of-sites.html

3 – http://blog.sucuri.net/2013/11/the-story-of-cliprect-a-black-hat-seo-trick.html

Getting rid for good is going to be very hard to say without knowing more about your specific situation.

Good place to start to improve your posture is:

1 – http://codex.wordpress.org/Hardening_WordPress

2 – http://codex.wordpress.org/FAQ_My_site_was_hacked

I’d start there before going too crazy with anything else.

In short, Blackhat SEO infections like what you’re dealing with aren’t quick little things to content with. What it’s really telling you is that you’ve hacked, compromised. Someone has gain access to your WordPress install and is abusing your audience and brand.

What are you doing or have you done to avoid this?

Thanks

That’s correct folks, the real issue here is the arsenal of payload being leveraged once inside the environment.

You are suffering reinfections because of the type of backdoors being leveraged, all designed to address half, if not all, the hardening recommendations in that Hardening documentation. Sorry we don’t have better news.

1 – you have to figure out how to stop the malicious request coming to your server. You can do this via modsec if you have a VPS, or leverage a firewall

2 – Once you have stopped the requests, then go about cleaning. If you don’t do it this way, you’ll clean simply to find it reinfected. Even if you remove the revslider or any other vulnerability plugins / themes. Once in your environment, consider it owned.

If you have an environment with multiple sits, consider your entire stack owned. You can’t trust JS, PHP or Images. We’re finding payloads injected into image headers and functioning as backdoors.

All the best

Hi @tristandenyer

That’s really odd. Someone put that website behind our Firewall. Who is the owner of that website?

Thanks