Întrebare

Ți-am dat mail, il (autocorrectul vrea sa ma facă cocalar, tot imi corecteaza il in i-l) pun si aici poate știe cineva mai multe:

Din câte am săpat pe net, se pare ca WordPressul tau are o vulnerabilitate, probabil de la un plugin sau o tema si ceva rescrie fisierul de htaccess (din cauza asta se modifica doar linkul din header si cele de la articole si nu cele din blogroll, de exemplu). Problema nu apare tot timpul pt ca htaccess e rescris des. Nu am timp acum sa sap mai mult, dar in locul tau as cauta pe net WordPress htaccess hack (sau l-as pune pe zoso, ca el se mai pricepe la astea si presupun ca are acces la tine la blog) si sa citi topicuri ca asta wordpress.org/support/topic/malware-hack-reinfecting-htaccess-file , unde scrie:

For anyone still pulling their hair out with this…

I run about 80 wordpress sites on the same server – htaccess files getting updated every couple hours. I went through changed all passwords, wordpress version updates, plugin updates, wordpress user accounts, ftp accounts, timthumb updates, htaccess permissions etc. – I did it all and it was still happening.

After pouring through my server logs I found that russian IP addresses were accessing “version.php” in my wordpress sites. (NOT the wp-includes/version.php – these were usually in the themes folder and in a couple cases right in the root of the website.)

Inside that version.php file was a php script called “Web Shell by oRb” that was causing the issue to reoccur. I removed these files and the problem has finally stopped happening.

I googled this issue and surprisingly nobody has any info on it (even sucuri) – hope this helps someone out