Comments on: WordPress Tip: WordPress Worm Requires Upgrade to 2.8.4

By: Tom

Tom — Fri, 11 Sep 2009 14:02:33 +0000

Richard, thanks for pointing out that users shouldn’t delete everything in their root directory. You’re definitely right. I made such a quick description of the task, I didn’t think anyone would actually follow my instructions. You must have had an old version of WP if you had to upgrade manually. The new automatic upgrade is a huge relief, given how often new versions are released.

By: Tom

Tom — Fri, 11 Sep 2009 13:44:17 +0000

Thanks Simone. I’m sure that will be helpful to anyone whose site was hacked.

By: Simone C

Simone C — Thu, 10 Sep 2009 18:03:00 +0000

Here the souce code of what the “worm” install ..
I have deobfuscate the nested base64 encoding and I’ve posted the source code …
you can use it to backup files and mysql dbs
Have fun

http://pastebin.com/f3c5ad549

By: Richard Hamilton

Richard Hamilton — Wed, 09 Sep 2009 18:40:35 +0000

Great post. Got me to update my system, which I needed to do manually. But, it worked, and the new version has some nice features (best being automatic update of plugins), so I should kick myself for waiting so long.

One thing I noticed in updating manually. I had a couple of other things going in my home directory (e.g., phplist), so the instructions to delete everything really meant (for me) to delete everything wordpress related (other than the exceptions noted).

Thanks, Tom, for making this information available to your readers.

By: Tom

Tom — Wed, 09 Sep 2009 06:00:33 +0000

Sorry to hear that you were attacked, but my post doesn’t really explain how to recover, just how to prevent. Lorelle’s post has more about recovering.

By: Consumer court

Consumer court — Tue, 08 Sep 2009 06:25:24 +0000

I did suffer from the attack and was very confused what to do and what not. It got to know now that i need to clear up my data base and make it correct again. Thank God i came to this post and i gt saved.

By: Tom

Tom — Tue, 08 Sep 2009 04:13:58 +0000

Judy, thanks for the comment and link to Lorelle’s post. Her post is a lot more informative, especially on how to diagnose whether you’re already infected.

By: What Did You Learn?

What Did You Learn? — Mon, 07 Sep 2009 14:43:57 +0000

[...] Background: The WordPress Worm struck the old Area 224 site. It struck quite a few sites. Here’s a great write-up on what happened from an appropriately named site: I’d Rather Be Writing. [...]

By: Judy Harper

Judy Harper — Mon, 07 Sep 2009 13:14:58 +0000

Hi Tom. Great post. However, if you’ve already been attacked, the hack goes deep into your WordPress database, so upgrading is not an immediate option; you’ll have to clean up the database first. Lorelle give some tips on (1) recognizing when you’ve been hacked and (2) cleaning up your database after a hack. You can find them at http://lorelle.wordpress.com/2009/09/04/old-wordpress-versions-under-attack/

- Judy