
If you are one of the many bloggers who got nailed by the nasties injecting malware into your innocent javascript files, I feel for you.
You see, it happened to me too. For the past week, all I’ve done is clean, re-clean, check, re-check and generally get more and more frustrated until finally it’s been a whole, ahem, 8 hours since the red Avast flag went up.
Phew (I hope).
Here’s what I did and worked for me.
- Make sure you have a backup. You have been taking backups right? Right? There are many choices, especially in terms of easy-to-setup and user friendly plugins. Get one, and get in the habit of always having a good backup.
- Update anything that needs updating: WordPress itself, plugins and themes. This is very, very important.
- Go to Sucuri, and have it scan your blog for free. It will tell you precisely which files are affected. Mostly it’s been jquery/jquery.js and l10n.js located inside wp-includes/js Wordpress folder. Sucuri will tell you the exact path.
- Remove the gunk: the malware is tacked on to the end of the file and looks like this:
var _0x4de4=["\x64\x20\x35\x28\x29\x7B\x62\x20\x3....
- Once you remove the offending code from a file, go back to Sucuri and re-scan. Repeat until Sucuri gives you a clean bill of health.
- Now, you need to plug the vulnerability to stop further attacks. Find every instance of timthumb.php or thumb.php in your WordPress installation. This is the file that is out of date, and must replaced with Timthumb 2.0. This is for those themes and plugins that use the script, and hasn’t been updated.
- Change your admin, ftp, and database passwords.
- Monitor every few hours to make sure the nasties haven’t crept back in.
- If all else fails, wipe your hosting clean, re-install WordPress, grab your content from the backup (you do have a backup, right?), and you should be up and running in under 30 minutes.
In my case, I had found that many instances of Timthumb were sitting in themes that I wasn’t using anymore, but had left installed. Mistake.
If you have themes or plugins that are installed, and you are not using, just get rid of them!
The other problem was that I only updated timthumb/php, and not thumb.php – forgot to search for it. Needless to say, a couple of hours later, the malware was back in the javascript files, I had to go through the procedure again.
I hope this is the end of this saga. I’ve made sure I’ve gone through WordPress’s hardening guide, and implemented most of the recommendations.
At the time of writing this post, things were still looking A-ok, and I now know more about WordPress security than I ever thought I would ever need to know.
For specifics on the how and the variants, check out this post on the Sucuri blog and this more technical and thorough walkthrough of the events.


It hits me every time. I watch as an older person (read: over 24 in this crazy world of Biebers and Zuckerbergs) struggles to retain their tried and true role of being the voice of reason, of wisdom, of experience. Yet, over and over again, I see them in danger of being discarded, not unlike a useless, unrecyclable piece of past-due baggage.



