Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: I can't tell why my site is showing malware warning.

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 44 posts

Re: Ask HN: I can't tell why my site is showing malware warning.

#31

Post by e03179 »

Overwrite core WordPress files first. Run WordPress Exploit Scanner to root out anything in the database, and WordPress File Monitor as a tripwire going forward.

http://wordpress.org/extend/plugins/exploit-scanner/

http://wordpress.org/extend/plugins/wordpress-file-monitor/

That's what I did when I had this same issue happen to me on my WP installs (yeah, the same hole infected other sites on the server). These plugins showed me what files on my server had be changed and where the offending code was.

How old is your WP install? The hole could actually be in a plugin you are using. That was the case with me.

Also, TimThumb.php was recently in the news as having a security hole in it.

For good measure, here is the Hardening Wordpress article from WP: http://codex.wordpress.org/Hardening_WordPress

Re: Ask HN: I can't tell why my site is showing malware warning.

#32

Post by justincormack »

fduran wrote: post #30
fduran wrote: post #6

Run this just in case (free) http://www.qualys.com/forms/trials/stopmalware/

to the person who downvoted me, why is running this or sucuri scanner a bad idea or bad advice when you suspect malware in your site?

Because it didnt find anything, while there were positive useful suggestions, and sightings of malware by actually visiting the site. What value is a link to a service that doesn't work?

Re: Ask HN: I can't tell why my site is showing malware warning.

#33

Post by pierrefar »

balsamiq wrote: post #28
Matt_Cutts wrote: post #26

Earlier quoted context omitted.

As soon as we detect malware, that info starts getting sent to various places (e.g. the safe browsing lists that browsers use). But the data can take a while to get everywhere; in this case, it sounds like it made it to browsers a little before webmaster tools. That's unfortunate, but in general we wouldn't want to hold off showing the info in the browsers for any reason, because more users would be infected. It's a…

Wow a reply from Matt Cutts himself! _blushes_ :) Thanks for the explanation, and it makes sense. One thing I would suggest is to update the docs to point this out! "Please trust the warning over what Webmaster tools says as they might take a while to update". Love the idea of the .htaccess for /wp-admin/, I'll make sure the WPEngine guys implement that for our site. So sorry for this whole hoopla everyone, and thank…

Thanks for the feedback. I'll pass it on.

And good luck with fixing the hack!

Re: Ask HN: I can't tell why my site is showing malware warning.

#34

Post by Matt_Cutts »

balsamiq wrote: post #28
Matt_Cutts wrote: post #26

Earlier quoted context omitted.

As soon as we detect malware, that info starts getting sent to various places (e.g. the safe browsing lists that browsers use). But the data can take a while to get everywhere; in this case, it sounds like it made it to browsers a little before webmaster tools. That's unfortunate, but in general we wouldn't want to hold off showing the info in the browsers for any reason, because more users would be infected. It's a…

Wow a reply from Matt Cutts himself! _blushes_ :) Thanks for the explanation, and it makes sense. One thing I would suggest is to update the docs to point this out! "Please trust the warning over what Webmaster tools says as they might take a while to update". Love the idea of the .htaccess for /wp-admin/, I'll make sure the WPEngine guys implement that for our site. So sorry for this whole hoopla everyone, and thank…

Happy to try to help, and good point about whether we should update the docs.

P.S. This incident aside, nice job on the site--bootstrapping is cool, and I like the idea of lo-fi mockups that are quick and easy to make.

Re: Ask HN: I can't tell why my site is showing malware warning.

#35

Post by absth »

What we have been seeing that web-malware that appears intermittently, only appearing to certain browsers and not appearing twice in a row to the same browser/IP, is usually pushed in via a FTP credential compromise.

The code often resides in template file, in config files and/or sometimes is also put into the database.

We've seen a lot of these kind of "intermittent" malware through the recent timthumb attacks on WP sites:http://www.stopthehacker.com/2011/08/30/timthumb-malware/

You've already got a lot of good information from the other responders, so I will not repeat the obvious, but great, points. Change password, check plugins..

Post reply on HN