Be Excellent To Each Other

Last night while looking at a (perfectly legit) wordpress blog hosted on my server, something rather odd happened. The java loading screen popped up momentarily (as if a java applet was loading - but there are NONE on this site) after which my computer started going properly mental.

Symptoms: Desktop, Program Files, Quicklaunch, and all other general personal files set to hidden. Antivirus, firewall, and taskmanager disabled in registry. Regedit disabled, and some fake scanner bullshit warning of disk errors with an option to buy the full version, blahblah. Booted into safe mode, disabled auto-starting virus bullshit in registry, then rebooted into normal windows and scrubbed up. A fucking pain in the arse but my PC is alive again.

Anyway, the major problem is that I have no idea how this infection occured. There are a few plugins installed on the blog in question, but nothing out of the ordinary. Third party 'scan my website for malware' apps also come up with nothing, so currently the owner of the website is shitting themselves something might be wrong with it but we can't pin down from where. Any ideas? ;(

Perhaps it was just coincidental and the nasty software was already on your machine before you even went to the blog site.

We got a very strange warning the other day from another blog site that was pinging us back that ours was infected with trojan malware, but I couldn't fathom a reason for that either. Whatever it is must be intermittant which makes it even more annoying.

Is there anything dynamically loaded that changes on each page impression? Ads, perhaps?

Anyway, it won't help with the server-side issue but I will once again recommend Sandboxie as an essential condom for your browser.

My leading suspicion is a plugin called Flickrpress, which loads in content dynamically from Flickr on each page load. Might be susceptable to some code insertion perhaps.

But cheers Craster will install the above now, wouldn't like to get caught again :/

You can find out what your PC is connecting to by opening a command prompt (as admin, if you're on Vista or 7) and using CD to move to your desktop (C:\Users\YourName\Desktop) and typing
Anything your PC connects to will appear in that text file (press CTRL+C to stop it).

Hmm, one scanning website reports that a bit of jquery used by the theme itself (jquery.jcarousel.min.js - probably used for the rotating featured images on the blog) is infected with this particular malware.

How's that then? Presumably jQuery is secure, but the shitty theme developer has either deliberately or accidentally bundled a compromised version?

Or any number of Wordpress holes have allowed someone to inject something into the jQuery in the theme.

What a ballache. I've overwritten the carousel jQuery script with a copy of the official one, and now I'm scanning the site to find all instances of where a dodgy non-needed PHP file that loaded the javascript was being included. Grrr.