<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div><div>On Apr 15, 2013, at 9:21 PM, Senthil Ramasamy wrote:</div><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Virus Scanner pick them up as Backdoor:Perl/Shellbot and have removed the above files and suspected backdoor entry was through wordpress. So, to avoid future attacks we have implement .htaccess file to limit specific IP address to access the wp-login.php as mentioned in<span class="Apple-converted-space"> </span><a href="http://forums.whirlpool.net.au/forum-replies.cfm?t=2085205" style="color: blue; text-decoration: underline; ">http://forums.whirlpool.net.au/forum-replies.cfm?t=2085205</a><o:p></o:p></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Today again we are seeing same files re-appear. We have removed those files again. But don’t know how they are getting in?<o:p></o:p></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><div style="margin-top: 0cm; margin-right: 0cm; margin-left: 0cm; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Has anyone seen this before and have a solution? Or point us to right direction?</div></span></blockquote></div><br><div>Going to have to get that Wordpress install fully patched. Had this happen (similar, a bank phishing site installed through old unpatched plugin script) to one of my customers. Unfortunately, depending on the security vulnerability, the .htaccess file probably won't have any effect.</div><div><br></div><div> Good luck!</div><div><br></div><div>Jeff</div></body></html>