DerekMartin.ca web development, spirituality, UFOs & the occult

Fixing my WordPress Malware Problem

dive into the code

You probably notice that for about 10 days, whenever you tried to visit my site, you saw a bright red page that said the site was dangerous, and was hosting malware. Google put that page up, not me. It did so because it tries to ensure you have the best surfing experience possible, and part of that means not getting your computer infected by anything.

I can't blame them for doing so, BUT they could have been MUCH more helpful in fixing the problem.

Essentially, what Google Webmaster Tools told me was "Your site is infected. Fix it." Much easier said than done. The site is complex, and there are about a thousand posts, and many more comments. While Google *did* point me to a few of the posts it had problems with, it did NOT tell me what the problem was, so I literally had no idea what I was looking for. It was SO frustrating.

Google's warning to me mentioned 3 sites that my code somehow referenced. I won't repeat their names here for fear that I'll get blacklisted again. So, I connected to the database and did a bunch of queries (listed at the bottom of this post) for the sitenames, as well as script & iframe tags, but didn't find any results.

Eventually I thought "there must already be solutions for this out there", so I Googled (ironically) and found the "WP-MalWatch" plug-in, which I promptly installed. It indicated a mysterious file (included at the bottom of this post, for your inspection) in my uploads directory, located at: html/wp-content/uploads/2009/09/446365.php

Anyway, I removed it and resubmitted my site to Google to be taken off the blacklist... BUT they didn't take me off the blacklist. Apparently something was still wrong, so I kept digging.

I found that my host (MediaTemple) has had more than a few security issues with WordPress installs on their network. MediaTemple was aware of the issue, and suggested using a 3rd party service called Sucuri to fix the problem. Apparently Sucuri is getting a lot of business from MediaTemple, because the offer MediaTemple customers a $10 discount. Unfortunately, that only brought the price down to $79 USD, which I thought was ridiculous, so I kept looking for fixes.

A blog post by Kyle Brady told me to look for eval(base64_decode in my files. Sure enough, I found some, and removed them, and re-submitted to Google, but again was not taken off the blacklist. No idea why, but it meant I had to keep digging.

I found another plug-in called "Exploit Scanner". It found some more problems. Specifically, it indicated that there were 4 administrator accounts. I am the only admin, so I deleted the other 3 and then changed all passwords.

Then there was the Pharma Hack, which it turns out I had also been hit by. So I removed that stuff and re-submitted to Google, but again was not taken off the blacklist. No idea why, but it meant I had to keep digging.

Then I found a blog post on Uhleeka.com, which pointed me toward using grep, a unix-based commandline file searching utility. I've used grep lots of times, but in this case I had no idea what term I should be searching for. Uhleeka helped. Here is the command I ran to find the final culprit:

grep -R "document.write(unescape" *

Here is the result it returned:

html/wp-content/plugins/google-analyticator/external-tracking.min.js:var st1 = 0;document.write(unescape('%3C%73% whole bunch of this crap was here 9%70%74%3E'));var gr0=0;jQuery(document).ready(function(){jQuery('a').each(function(){var a=jQuery(this);var href=a.attr('href');if(href==undefined)

As you can see, someone somehow embedded some malicious code in my Google Analytics plug-in's external  javascript (where database queries wouldn't see it). Would I have thought to look there? Nope. I took out the line starting with document.write, and resubmitted my site to Google for the 4th or 5th time. 3 hours later I was off the blacklist.

I found this entire process EXTREMELY frustrating. In all, I spent 4-5 hours on it, but never did I feel like there was a direct path to follow to get to the point where "for sure" my site would be fixed. I can't imagine how a non-programmer would cope with this. I guess they would just pony up the $79 to Sucuri and be done with it.

The obvious insight from this is that there's a huge business opportunity in this market for someone who can write & sell a simple to use anti-malware/hack service or plug-in for $20-$50 USD.

P.S. -- my facebook account just got broken into somehow, and it posted an "ipad giveaway" to my wall, and emailed all my friends about it, and invited all my friend to an "ipad giveaway event hosted by derek martin". WTF? I hope it's easier to fix than the malware problem was!

• select * from wp_options where option_name = 'wp_check_hash'
• select * from wp_options where option_name = 'class_generic_support'
• select * from wp_options where option_name = 'widget_generic_support'
• select * from wp_options where option_name = 'ftp_credentials'
• select * from wp_options where option_name = 'fwp'
• select * from wp_options where option_name LIKE 'rss_%' (EXCEPT: rss_language, rss_use_excerpt, and rss_excerpt_length)
• select * from wp_comments where comment_author_email like '%eval(%' or comment_author_url like '%eval(%' or comment_content like '%eval(%'
• select * from wp_postmeta where meta_value like '%eval(%'
• select * from wp_posts where post_content like '%eval(%' or post_title like '%eval(%'
• select * from wp_comments where comment_author_email like '%base64_decode%' or comment_author_url like '%base64_decode%' or comment_content like '%base64_decode%'
• select * from wp_postmeta where meta_value like '%base64_decode%'
• select * from wp_posts where post_content like '%base64_decode%' or post_title like '%base64_decode%'
• select * from wp_comments where comment_author_email like '%BADSITE1.biz%' or comment_author_url like '%BADSITE1.biz%' or comment_content like '%BADSITE1.biz%'
• select * from wp_comments where comment_author_email like '%BADSITE2.name%' or comment_author_url like '%BADSITE2.name%' or comment_content like '%BADSITE2.name%'
• select * from wp_comments where comment_author_email like '%BADSITE3.us%' or comment_author_url like '%BADSITE3.us%' or comment_content like '%BADSITE3.us%'
• select * from wp_comments where comment_author_email like '%&ltscript%' or comment_author_email like '%<script%' or comment_author_url like '%<script%' or comment_author_url like '%&ltscript%' or comment_content like '%<script%' or comment_content like '%&ltscript%'
• select * from wp_comments where comment_author_email like '%<iframe%' or comment_author_email like '%&ltiframe%' or comment_author_url like '%<iframe%' or comment_author_url like '%&ltiframe%' or comment_content like '%<iframe%' or comment_content like '%&ltiframe%'
• select * from wp_postmeta where meta_value like '%BADSITE1.biz%'
• select * from wp_postmeta where meta_value like '%BADSITE2.name%'
• select * from wp_postmeta where meta_value like '%BADSITE3.us%'
• select * from wp_postmeta where meta_value like '%<script%' or meta_value like '%&ltscript%'
• select * from wp_postmeta where meta_value like '%<iframe%' or meta_value like '%&ltiframe%'
• select * from wp_posts where post_content like '%BADSITE1.biz%' or post_title like '%BADSITE1.biz%'
• select * from wp_posts where post_content like '%BADSITE2.name%' or post_title like '%BADSITE2.name%'
• select * from wp_posts where post_content like '%BADSITE3.us%' or post_title like '%BADSITE3.us%'
• select * from wp_posts where post_content like '%<script%' or post_content like '%&ltscript%' or post_title like '%<script%' or post_title like '%&ltscript%'
• select * from wp_posts where post_content like '%<iframe%' or post_content like '%&ltiframe%' or post_title like '%<iframe%' or post_title like '%&ltiframe%'