1. Advertising
    y u no do it?

    Advertising (learn more)

    Advertise virtually anything here, with CPM banner ads, CPM email ads and CPC contextual links. You can target relevant areas of the site and show ads based on geographical location of the user if you wish.

    Starts at just $1 per CPM or $0.10 per CPC.

Contact 7 wordpres plugin virused?

Discussion in 'PHP' started by Fracisc, Dec 9, 2012.

0
  1. #1
    I have code injected into that plugins files. I have cleaned up but in a few hours it is back. I have the same issue on many blogs. Anyone else experiencing this? How can I fix the problem? I have changed DB and FTP passwords.
     
    Fracisc, Dec 9, 2012 IP
  2. Tony Brar

    Tony Brar Active Member

    Messages:
    220
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    75
    #2
    You are going to have to give us way more information.
    Post again with source code and LOTS of details.

    Thanks,
    -Tony
     
    Tony Brar, Dec 9, 2012 IP
  3. Fracisc

    Fracisc Well-Known Member

    Messages:
    3,670
    Likes Received:
    10
    Best Answers:
    1
    Trophy Points:
    195
    #3
    Nothing much to say.. A few files of the contact7 wordpress plugin had eval(base64_decode()) in them. I have cleaned up and after a few hours it was back. Now I added captcha and I am waiting to see what will happen..
     
    Fracisc, Dec 9, 2012 IP
  4. Tony Brar

    Tony Brar Active Member

    Messages:
    220
    Likes Received:
    2
    Best Answers:
    0
    Trophy Points:
    75
    #4
    I was thinking source code.
    Personally, I don't use wordpress. I don't know how it works. I just thought that, with more details, wordpress users could help you better.

    Sorry I don't know how to use wordpress.
    -Tony
     
    Tony Brar, Dec 9, 2012 IP
  5. Rukbat

    Rukbat Well-Known Member

    Messages:
    2,908
    Likes Received:
    37
    Best Answers:
    51
    Trophy Points:
    125
    #5
    Did you try downloading a fresh copy of the plugin from the source site, and uploading it to your site?
     
    Rukbat, Dec 9, 2012 IP
  6. FFMG

    FFMG Well-Known Member

    Messages:
    1,091
    Likes Received:
    39
    Best Answers:
    0
    Trophy Points:
    160
    #6
    You still need to tell us a bit more.
    I have wordpress and contact 7 with no issues, (but of course I could just be lucky).

    I have the latest files, (3.4.2 wordpress and 3.3.1 contact 7).

    Are those up to date? What other plugins do you have?

    Also change your server passwords, (root, ftp etc...), often hackers just make small changes like those you are seen rather than a full blown defacement.

    FFMG
     
    FFMG, Dec 9, 2012 IP
  7. Fracisc

    Fracisc Well-Known Member

    Messages:
    3,670
    Likes Received:
    10
    Best Answers:
    1
    Trophy Points:
    195
    #7
    Everything is up to date. I deleted the plugin and added a fresh copy. It got virused again. I removed the plugin and the problem disappeared.
    Sometimes the wp-config file got virused too. Now it seems that everything is okay, after I completely removed that plugin and did not add it back.
    I guess the plugin has issues.. Even though I limited the maximum characters in my contact forms..
     
    Fracisc, Dec 10, 2012 IP
  8. FFMG

    FFMG Well-Known Member

    Messages:
    1,091
    Likes Received:
    39
    Best Answers:
    0
    Trophy Points:
    160
    #8
    I still doubt there is something wrong with the plugin, (or wordpress), but you might want to contact the developer directly to see what he has to say.

    I still think that your password has been cracked, (not your admin one, your server), there would be no harm in changing all your passwords.
    Are you using the same password all over the place?

    What other plugins are installed?

    FFMG
     
    FFMG, Dec 10, 2012 IP
  9. Fracisc

    Fracisc Well-Known Member

    Messages:
    3,670
    Likes Received:
    10
    Best Answers:
    1
    Trophy Points:
    195
    #9
    I have changed all my passwords and the problem remained.

    Plugins:
    Akismet (x2)
    All in One SEO Pack (x2)
    Google XML Sitemaps
    Lightbox Gallery
    Milat jQuery Automatic Popup (x2)
    Newsletter (x2)
    NextGEN Gallery
    Post-Plugin Library
    SEO SearchTerms Tagging 2 (x2)
    Sexy Comments
    Subscribe to Comments Reloaded
    WP-Optimize
    WP-PostViews
    WP Events Calendar
    Wysija Newsletters
    Contact-7 plugin (x2) was removed!

    What is strange is that this plugin http://www.satollo.net/plugins/newsletter updates too often, almost daily. The author confirmed that the plugin is his and he does the updates and it is safe.

    So.. I dunno what to say.. I am still not sure how they got in. All I can say is that after removing the contact-7 plugin, the problem went away.

    The (x2) means that I had that plugin on both my virused sites. Some of my other sites have the same plugins but had no problems. Maybe they are not interesting enough for the hackers..
     
    Fracisc, Dec 10, 2012 IP