THE MOLITOR FORUMS » Topic: Virus file

THE MOLITOR on "Virus file"

THE MOLITOR — Wed, 17 Sep 2014 09:57:33 +0000

Thanks for following up!

Getting hacked is not fun at all. Here's a Google search for you to review: http://tinyurl.com/oqngh5b

Best,

Chris

derekphl on "Virus file"

derekphl — Wed, 17 Sep 2014 09:13:34 +0000

Hey, not to worry, turns out it was a permalinks issue. I set WP permalinks to default, and then back again and it's working again.

Now I just have to make sure I don't get hacked again! :-(

derekphl on "Virus file"

derekphl — Wed, 17 Sep 2014 06:16:07 +0000

Hi Chris,

I appreciate that this request contravenes point 2 a little, bit any help would be appreciated ... I have installed a fresh instance of WP and B&M on top, directed to the original DB and copied the uploads directory to the right place but I get a 'Not found' error when trying to get to a WP Page, which is odd because all the content seems to be there.

If you want to see what I mean, you can access thisisderek.com using guest/guestuser1!

Thanks, Derek.

THE MOLITOR on "Virus file"

THE MOLITOR — Tue, 16 Sep 2014 10:15:37 +0000

Hi there,

No, "libworker.so" is not an actual theme file and should not be there. Looks like you've been hacked :-/

Best,

Chris

derekphl on "Virus file"

derekphl — Tue, 16 Sep 2014 09:22:46 +0000

Seems my site was compromised with a virus called Unix.Trojan.Roopre.

The infected file was wp-content/themes/wpbm2/libworker.so, would you be kind enough to confirm if this is an actual theme related file or one that some git has managed to upload?

Many thanks.