Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running a server on Ubuntu 10.04 running a word press website, and recently a virus scan revealed that I have several malicious scripts sitting in the word press folder. In particular they are in the cache and temp folder of a theme that I'm currently using.

I opened them with VIM and read through them, they are certainly bots and spamware, one of them is even called c99 injecktor. I am very interested in how these scripts can be injected into these folders, and what actions I should take upon discovering them. Should I simply delete them?

Also, is the injection caused by security flaw of word press, or should I be worry about anything else other than getting a more up-to-date version of word press in my new server?

share|improve this question
up vote 6 down vote accepted

You were most likely compromised through a vulnerable installation or theme, probably through something that is now known and fixed.

First, once you've been compromised a little, it's best to assume you've been compromised a lot and start fresh. Read up on the answers to this question: My server's been hacked EMERGENCY

Second, besides updating to the latest versions, you can take extra steps to help prevent damage when some part of your Wordpress install has a vulnerability. Read up on more from this question: Protecting WordPress installations

share|improve this answer
Coolbeans, thanks for the info they are very helpful. Yes I am now working on launching a new instance of my server :) – Xavier_Ex Aug 30 '12 at 16:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.