Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Suddenly, I see some of my blog files(wordpress) contains some <iframe> tags with links to some websites. How does it happen? What do I have to do to remove this virus and clean my website?

I opened few files using a text editor and removed the <iframe> code. Also, changed all my FTP password. How can I ensure that my site is clean now? What are all the preventions I can take to avoid this in futre?

share|improve this question
    
I could not add iframe,virus and blog tags since I don't have efficient reputation. Sorry, if the tags are wrong. –  San Jul 28 '10 at 12:07
    
I added you iframe, blog and virus are redundant since there is wordpress and security already. –  HoLyVieR Jul 28 '10 at 12:21

5 Answers 5

up vote 6 down vote accepted

Cleaning a WordPress install, or any site, of such files is generally straightforward. If there's a pattern, do a search of the relevant files and then replace the bad code.

In the case of WordPress, there are a few different sources of bad code (probably others):

  1. An already infected theme was installed
  2. Your site's FTP password was guessed and hacked
  3. WordPress is insecure and allowed a worm to be installed

One thing you can do is install TAC (Theme Authenticity Checker), which will scan for the bad stuff.

See Hardening WordPress for steps to take to make WordPress more secure. But basically when I've seen this happen what I do is back everything up (database and all files), then blow that install away and install a fresh WordPress install, fresh replacement plugins, and a fresh theme (if your theme was custom, get rid of the bad code first!).

Googling for "wordpress infection" should get you other articles with similar advice.

share|improve this answer

Obviously, always make sure you have the latest version of Wordpress installed. The admin panel tells you when WP needs updating. If you don't log in too often, you could follow the wordpress.org blog feed to keep on top it.

Every time you download a new theme you should search through the source code for any use of base64_decode or eval (Notepad++ makes this easy), this is the primary way to hide malicious code or spammy links. You can copy the encoded HTML/PHP into an online base64 decoder if you like, to see what it's actually doing.

share|improve this answer

or you could just do an in-file search and replace of your folders. Because iframes are evil by default...

share|improve this answer
    
How can I do that? Is there any tool available? –  San Jul 30 '10 at 12:24

Are you running on a shared server?

I've previously seen on shared servers instances where one account has been hacked and it's been possible for the hackers to access other sites on the shared server through files which the PHP users has access to.

share|improve this answer
    
If this is the case, you should get your host to use PHP's "safe mode" which protects against this sort of thing. –  DisgruntledGoat Jul 29 '10 at 13:16
    
Yes, Loftx. It's a shared server. How can I prevent these kind of attacks? –  San Jul 30 '10 at 12:24
    
@DisgruntledGoat How can I check whether it's is safe mode or not? –  San Jul 30 '10 at 12:25
    
@San: If safe mode is enabled then ini_get('safe_mode') will return true. You could also try one of these functions: php.net/manual/en/features.safe-mode.functions.php –  DisgruntledGoat Jul 30 '10 at 14:44
    
Also note that safe mode has been removed as of PHP 5.3 so in that case your host will have to do something else to restrict access. –  DisgruntledGoat Jul 30 '10 at 14:47

You can use the "Secure Wordpress" plugin which at the beginning was developed by Frank Bueltge. Now sitesecuritymonitor.com maintains it. The plugin contains a method to scan your Wordpress blog against known Vulnerabilities.

See: http://www.sitesecuritymonitor.com/secure-wordpress-plugin

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.