HELP - Exploit:JS/Blacole.AR on one of my sites - WTF do I do?
 

I go on my site and chrome asks me to update a plugin.

I do NOT update anything or click ok.

Then Microsoft Security Essentials removes Exploit:JS/Blacole.AR from my chrome cache files.

The site is running the latest Wordpress version and only adsense banners.


How can I find out what is going on?

Halp!!!!

you start by disabling your plugins

reboot the internet

Hmpf disabled all plugins and reinstalled theme and wp.


Seems gone now.

That sucks there guy

Interpol has been notified.

Run a scan of your site through this url to see what is going on.
http://sitecheck.sucuri.net/scanner/




.

now perform a backtrace and post the results here

This scanner is great, I reccomend to use it too.

So, in order to find exploit on your server just use special aniviruses or analyze your html code

Thanks so much for posting this.

I had tried some other scanners that did not find anything, this one did!

Probably your js files are infected with an inject code probably because the locations where your js files are stored where not chmod in a good way.

Did you update a new theme on it?
If so, it was probably in the themes code and is now going all over your server.

Had a similar issue recently, and it infected other wp installs on the same server.. thought it was cleared up - it came back... only way for me to get rid of..

backup all the infected sites (ftp will probably fail - but cpanel zip / backup works) - backup databases with pmpmyadmin to your local machine just in case..

make sure you backed up everything, maybe use cpanel files viewer to do a zip backup of the entire directory.

ftp download your uploads folder in wp-content,
ftp download your wp-config file in root

then delete ALL the files... everything

re-upload fresh install of wordpress files
re-upload wp-config

install the exploit scanner plugin from wordpress.org - so it checks your database (and files.)

do not upload your /uploads/ until you have virus scanned it locally

cry about any custom theme mods you just lost

only get your plugins and themes from wordpress.org

change your admin password to a looong one.. change your cpanel password.. truly paranoid - change your sql password for each database and update your wp-config with the new pass.

I think that's all the steps, but I am a little over blogged and sleepy at the moment - if you backed up everything it won't matter if I missed a step.