0

Hi when I try to enter my site I get redirected to another site. IT appears the htaccess file has been changed. When I scan the site with Sucuri I get this error Known javascript malware. Details: http://sucuri.net/malware/malware-entry-mwhta7 Location: http://ca-no.ru/example/status.php

How do I fix this permanently? I already had this problem last week and reset the htaccess file, however it happened again.

1

This is a case of general security. At a minimum do the following steps:

  • Delete the file you found in wp-admin
  • Delete the htaccess file
  • Download the official wordpress from wordpress.org and upload it to your server, overwriting anything it finds. If possible delete the wp-admin and wp-includes folders and any files starting with wp- in the root folder.
  • Do the same for any plugins or themes, use local backups if they aren't from the repository
  • Set up the correct permissions for your folders very important
  • Move wp-config.php one folder up from your index.php if possible
  • Do the same for any other WordPress installs on that server, if one is compromised, they're all compromised, and you need to keep them all up to date
  • Check for Timthumb, if you're using it consider using the WordPress APIs instead, and if you won't, then make sure you're using the very latest version.
  • Run your active themes through the WordPress theme check plugin, fix as many of the warnings and deprecated notices as is possible
  • Check your plugins for security breaches. Some people use plugins that are by design gaping security holes, e.g. embedding PHP code in posts
  • Perform appropriate checks on any non-WordPress software installed.

If you have backups, remember that simply restoring them will not make everything fine, as you're still open tot he same attack. You need to close the hole that let the malware in.

For good measure you should also:

  • Use FTP or shell to change the file system, and do manual wordpress/plugin updates, only the wp-content/uploads folder should be writable
  • Change the first admin user to a normal user and use a different admin account, and change the user name
  • Use any database prefix other than wp_
  • Use the WordPress upload mechanisms and WordPress filesystem API instead of reinventing the wheel when writing uploaders or writing/reading files using the native PHP file APIs
  • Disable the use of eval in php.ini
  • Always keep WordPress up to date and avoid deprecated APIs
| improve this answer | |
  • Excellent explanation, could you explain further what you mean by changing the file system? – urok93 Mar 27 '12 at 11:25
  • Writing/reading/editing files, you can use the PHP file APIs but it's safer to use the WordPress APIs. The WordPress APIs will also handle requesting FTP login details if direct write access is unavailable with no extra effort on your part – Tom J Nowell Mar 27 '12 at 11:58

Not the answer you're looking for? Browse other questions tagged or ask your own question.