Yep, client hit for the second time today too, after full re-installs on WP and the non WP sites affected last week. so much for their new scanning procedures eh?

its exactly the same as the incidents with Godaddy a few weeks ago, you spend hours and hours putting it right to wake up and find it done again.

at least Godaddy have a "revert to date" feature on their backup system so you can just revert to your last known safe date files, MediaTemple is a f'in nightmare by comparison.

I began dealing with this on 8/6. My affected site is using Wordpress [newest version. In fact, I upgraded the night before this began] via Media Temple. Media Temple didn't give me much help, aside from posting a bunch of links in reply to my support ticket of what "might be" the issue. I ended up reading about "johnnyA" after doing tons of searches. I deleted the user, found malicious code in a sidebar.php and deleted it, requested another Google review. My site began working fine. Now, a week later, I'm right back where I started - with my site being blocked and Media Temple "looking into it".

The problem for me is I'm an idiot when it comes to this stuff and I'm not tech savvy at all. So, while those of you who know what you're doing had a rough time searching for code, etc - imagine what it's like for me, someone who hasn't a clue what to do, what to look for or even what the hell "grep" is.

The kicker is that my personal site is running Wordpress NOT via Media Temple and I haven't had one issue at all. I feel like I've received some sympathy from Media Temple, but not any help. Whether it's a security issue on their end or not [I still believe it is], I can't possibly figure out how to fix things by any instructions I'm finding online because when it comes to this stuff, I'm about the intellectual equivalent of a toddler.

I'm really aggravated. I was able to look at a dropdowns.js within my Wordpress theme and did find the var st1 = 0;document.write(unescape .. thingy. I'm not even using the dropdown feature so I deleted it, but also have a fresh one that I just downloaded in case I do need it.

Seriously - this entire situation has been frustrating for many people who KNOW what they're doing, yet what about us who don't?

PS: I've been told so many times by Media Temple to make sure my Wordpress and plugins are up-to-date, that it truly makes me believe they feel I am the reason for this happening. My plugins and Wordpress were up-to-date, which makes this even more frustrating. I'm basically at the mercy of someone at Media Temple "possibly" helping me. The $20 credit they've given me over this doesn't nearly cover the time and aggravation I've spent trying to understand how to fix this myself.

Ugh, he got me again!

I am so DISENCHANTED with mediatemple! Sure, we can say "they have to" product their business from liability of downed site. But this is so obviously not a general WP issue: it is one specific to WP@ mediatemple! LAME B.S.

I've been dealing with this problem too. Found the JohnnyA as a wordpress user.

The problem with not knowing how the initial upload occurred is that it is difficult to seal definitively.

It might be worth looking around on hacker sites to see if the bragging reveals any details. I could imagine, for instance, an exploit that used some of the file upload plugins for TinyMCE.

I found another named fwrite.php

thanks to all contributors (what a pain/waste of a day)

I also found
eregi.php
is_writable.php
is_file.php

thanks to all contributors (what a pain/waste of a day)

By the way, we updated our blog post regarding security. I invite you to please read it and let us know if you have any further questions:

(mt) Media Temple Weblog - Security Facts

Thanks!

I've been tearing my hair out over this. I was thrilled to find this page after desperately typing "1RqLcpt" into Google. Now, I'm back to hair removal after finding quite a few affected files across multiple domains.

There's a lot of very useful and important information here. I'm hoping it will eventually be possible to compile all the known resolution methods into some kind of tutorial for systematically tackling the problem. I've already lost one client due to their site being blocked/blacklisted, so I'm not happy.

The main thing that concerns me is that (mt) doesn't know where the hole is - or precisely how it's being exploited yet. With all due respect to them and their efforts, I have a sinking feeling I'm going to be hunting for obscure snippets of code until they (and the rest of us) do know for certain.

Based on what I've read here and seen on my own account, I'm convinced that TinyMCE does play a significant role in this. Here's something from last year that seems disturbingly relevant:

http://yehg.net/lab/pr0js/a...

I could be wrong, but I suppose we'll find out.

I'm a tech support agent over at (mt) Media Temple.

We can confirm that this blog post is correct. From internal investigations, we're finding several variations of injected obfuscated code. Right now there's no sign of our infrastructure being breached, or WordPress itself being breached. The vast majority of compromised sites are running 3rd party plugins and themes. These themes appear, at this point, to be the primary point for the malware to be injected into. This is still under investigation. We cannot confirm this 100% as there appears to be other vectors but, for now, themes should be audited for security loopholes.

A recent Softpedia article states:

"The mass compromise was detected by Websense's ThreatSeeker Network, and even though the affected websites are hosted at Media Temple, this does not imply any security problems with the hosting company's servers or infrastructure. Similarly to other hosting providers, Media Temple has had its share of compromised websites under its roof in the past and this is because hackers systematically scan entire address spaces for vulnerable targets, before proceeding to infect them."

You can read more about Websense' findings here: http://bit.ly/91vTvU

(mt) Media Temple is currently working on a blog post to address what customers are facing, working on helping customers scan and clean up their blogs from these attacks. We're committed to being as transparent as possible with our findings to aid others being affected, regardless of where they are being hosted.

Attacks like this affect the internet community as a whole, it's important to work together and share information. For the time being, we share our information and resources at http://mediatemple.net/secu...

If you're a (mt) customer and have any questions, contact us 24/7.

I've been hit with this hack. Incidentally, the second hack since I've been on MT. I'm intrigued as to why you think the fault doesn't lie with MT and lies elsewhere (or is it simply because MT says it's not their fault?)? My experience of dealing with them suggests that at least part of the blame lies at their door. The fact that they haven't detected the attack vector yet, despite there being (at least) two bouts of this attack, one being after we know all users changed their passwords, seems to call into question the quality of their tech staff. Either that or their covering up.

I'm still searching for the trojan files. My solution for the time being is moving to a different host after cleaning my theme files (not that I've found anything in them) and cleaning my database.

<div markdown="0">

Hi guys, so I am facing the same problems and I am also on (mt) GS platform. I think old versions of wordpress are the point of entry, but there is no certainty.

Anyhow, I wanted to add few lines of bash that I use to search for these exploits across 20 sites...

To find the stuff in the JavaScript files I use:

find . -name "*.js" -exec grep -q "%[0-9A-Z][0-9A-Z]%[0-9A-Z][0-9A-Z]%[0-9A-Z][0-9A-Z]%[0-9A-Z][0-9A-Z]%[0-9A-Z][0-9A-Z]%[0-9A-Z][0-9A-Z]%[0-9A-Z][0-9A-Z]%[0-9A-Z][0-9A-Z]" '{}' \ -printf "%Td-%Tm-%TY %TT %p&#092n"

(displays path with a timestamp to a file containing the exploits while searching for these %TWOCHARS%TWOCHARS% which are characteristic when 7 in a row)

That covers all bases and I run it daily and monitor file changes just in case.
I improved security of some WP installations too.

Plus some resources:
I use this to confirm the problem is gone - http://www.avg.com.au/resou...

This helps me understand what hackers want - http://www.tareeinternet.co...

And this is something that helped me with RegEx - http://www.gskinner.com/Reg...

Good luck guys!

Then to make sure and extend my search, I use:

find . -name "*.php" -exec grep -q "[a-zA-Z0-9&#092/&#092+]&#092{255,&#092}" '{}' \ -printf "%Td-%Tm-%TY %TT %p&#092n"
find . -name "*.js" -exec grep -q "[a-zA-Z0-9&#092/&#092+]&#092{255,&#092}" '{}' \ -printf "%Td-%Tm-%TY %TT %p&#092n"

(which finds lines longer than 255 characters... kinda accurate)

Then (maybe an overkill...) I do this to scan the PHP files:

find . -name "*.php" -exec grep -q "base64(" '{}' \ -printf "%Td-%Tm-%TY %TT %p&#092n"
find . -name "*.php" -exec grep -q "eval(" '{}' \ -printf "%Td-%Tm-%TY %TT %p&#092n"
find . -name "*.php" -exec grep -q "gzinflate(" '{}' \ -printf "%Td-%Tm-%TY %TT %p&#092n"
find . -name "*.php" -exec grep -q "str_rot13(" '{}' \ -printf "%Td-%Tm-%TY %TT %p&#092n"
find . -name "*.php" -exec grep -q ";document.write(unescape(" '{}' \ -printf "%Td-%Tm-%TY %TT %p&#092n"

(these give some false positives, but I'd rather check to make sure)

</div>

Sucks man. I had a big meeting today where a contact hyped up what a great tech team we're on and my site had been malware blocked by google.

Anyway,

Another thing to remember to do, if you can't even get to your site anymore is the following:

Log in through cmd line in mysql and do:

SELECT * FROM wp_users ORDER BY ID DESC;

In my instance the last two users in there were "johnny" users. Make note of the user ids and delete the johnny rows.

ALso remove corresponding rows from wp_usermeta that match the user_ids you just deleted.

I have 5 sites I manage on Media Temple each with their own account and a wordpress install with version 3.0. All were compromised with the JohnnyA malware attack.

This appears to be more and more related to Media Temple's lack of ACL rather than a wordpress exploit. However, it greatly disappoints me that they have failed to come forth and admit they "screwed up"...again.

I found the offending rootkit exploit located in folders nested deep without anything in common to the locations with other sites I manage. You can add these file names to the list:

chmod.php
fopen.php
mkdir.php

Still the only way to locate and eradicate the exploit is to use the following "grep" commands with the above mentioned string both for the javascript and php rootkit.

grep -R "document.write(unescape" *

grep -iR --include "*.php" "[a-zA-Z0-9\/\+]\{255,\}" *

After you're done make sure to send a nice note to Media Temple demanding a years free hosting for the trouble...it wasn't too long ago we all had the hassle of changing our MySQL passwords due to a lack of security measure by Media Temple as well.

I've been dealing with this issue today as well, and thought I'd share some of what I've encountered.

I wasn't able to find "is_writable.php" until later, but another file called "fopen.php" caught my attention first. The code inside wasn't found with your find command above, as there were spaces (eg: "$o = " instead of "$o="). So the search I used was :

find ./ -name "*.php" -exec grep -l "$o = '1RqLcpt" {} \

With this search I'm finding a bunch of files named after different PHP functions; chmod.php, mkdir.php, eregi.php, etc.

Frustrating, as I manage a bunch of sites and it's tough to track down where the initial intrusion occurred.

Do you have anything to grep for to find the "is_writable.php" file? I don't have a file of that specific name.

I posted my steps to remove the malware, too:
http://www.uhleeka.com/blog...

Alika

thanks for the great info, one thing i'm having a hard time finding out though is how they got in and performed this hack in the first place, what / where is the weakness that needs to be hardened? someone's ftp password? a hole in wordpress? what?