{"id":11967,"date":"2010-05-11T12:15:14","date_gmt":"2010-05-11T19:15:14","guid":{"rendered":"http:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/?p=11967"},"modified":"2010-05-11T12:15:14","modified_gmt":"2010-05-11T19:15:14","slug":"wp-cache-plugin-creating-firesavez7-virus-zombie","status":"publish","type":"post","link":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/11967\/wp-cache-plugin-creating-firesavez7-virus-zombie\/","title":{"rendered":"WP Cache plugin creating firesavez7 Virus Zombie?!"},"content":{"rendered":"

\"\"<\/a>If you have no idea what i’m talking about, you’re one of the lucky few!<\/p>\n

This weekend my sites were attacked by a virus trying to install maleware and redirecting visitors to URL that started with firesavez7.com\/ and then a long line of characters that led straight down a path to virus hell.<\/p>\n

I have enough computer\u00a0prophylactic mechanisms in place that I did not download anything but the job of cleanup is just beginning.<\/p>\n

I was out of town at a conference this weekend and was unable to be in front of my computer, but while frequently checking my analytics with my iPhone app I noticed my daily traffic, bounce rate and time on site were WAY down. \u00a0Like almost non-existent!<\/p>\n

My sites are hosted at Bluehost, and with a little research discovered that they were indeed a victim of this attack along with many other providers.<\/p>\n

The Solution was not that bad<\/strong><\/p>\n

To initially resolve the problem, I had to restore my entire public_html directory to a previously backed up version from about a week ago, this was Sunday night. \u00a0That seemed to solve the problem.<\/p>\n

I went the entire day yesterday with no\u00a0occurrence\u00a0of the dreaded redirect notice and anti-virus alarm. \u00a0Site traffic, time on site and bounce rate (vitals) were normal….whew, that was close.<\/p>\n

But the dead rose to feed again<\/strong><\/p>\n

Tuesday is my marketing day. \u00a0The day that I send an update to my entire consumer and agent database (9,100 recipients of this email update) to notify them of the articles I wrote this week about claiming California’s tax credit.<\/p>\n

Initially, there were no issues….and then it started. \u00a0One, then two, then three emails came rolling in warning me that I was sending out a virus! \u00a0HOLY S%&T! \u00a0This isn’t happening. \u00a0I saw my reputation being flushed before my eyes.<\/p>\n

I screamed through my site with absolutely no challenges, no virus, no warnings, no redirects….what the hell was going on?!<\/p>\n

I jumped on the phone with the smartest and nerdiest guy I know, Ryan Hartman<\/a>. \u00a0He mentions that it’s common for viruses to attack your .htmaccess file in WordPress – so we look at it.<\/p>\n

Ryan saw some stuff in there Read more<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

This weekend my sites were attacked by a virus trying to install maleware and redirecting visitors to URL that started with firesavez7.com\/ and then a long line of characters that led straight to virus hell.<\/p>\n","protected":false},"author":67,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3,19],"tags":[474,475,473,281],"class_list":{"0":"post-11967","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"hentry","6":"category-blogging","7":"category-technology","8":"tag-bluehost","9":"tag-cache-plugin","10":"tag-firesavez7-virus","11":"tag-wordpress","13":"no-featured-image"},"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":3286,"url":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/3286\/understanding-the-difference-between-wordpresscom-and-wordpressorg-plus-a-little-bit-about-custom-domain-names\/","url_meta":{"origin":11967,"position":0},"title":"Understanding the difference between WordPress.com and WordPress.org plus a little bit about custom domain names","author":"Cheryl Johnson","date":"June 28, 2008","format":false,"excerpt":"Here's a point of confusion I often notice when people begin their search for a blogging platform: There are two different flavors of WordPress. WordPress.com is a hosted platform. You go there and sign up for account, pick a pre-designed theme, and start blogging.\u00a0\u00a0 It's free, it's very easy.\u00a0 Software\u2026","rel":"","context":"In "Blogging"","block_context":{"text":"Blogging","link":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/category\/blogging\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":8309,"url":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/8309\/multiple-blog-hosting-and-your-files-a-project-bloodhound-problem\/","url_meta":{"origin":11967,"position":1},"title":"Multiple blog hosting and your files. A Project Bloodhound inquiry for DIY WordPress publishing.","author":"Brad Coy","date":"May 8, 2009","format":false,"excerpt":"I'm in need of clarity. Being mostly clueless to the concept of file management and hosting in general has led me here by way of looking to publish more then one blog.\u00a0 That, and after spending far too much time with \"online and phone help\" with what should be a\u2026","rel":"","context":"In "Blogging"","block_context":{"text":"Blogging","link":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/category\/blogging\/"},"img":{"alt_text":"hosting-control-center-file-manager-1","src":"https:\/\/i0.wp.com\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-content\/uploads\/2009\/05\/hosting-control-center-file-manager-1.jpg?resize=350%2C200","width":350,"height":200},"classes":[]},{"id":1800,"url":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/1800\/pimp-my-posts-with-word-press-plugins\/","url_meta":{"origin":11967,"position":2},"title":"Pimp My Posts (with Word Press Plugins)","author":"Lani Anglin","date":"August 14, 2007","format":false,"excerpt":"Okay, so I wanted to say \"pimp my blog\" but that doesn't make for an alliteration within a title... I recently found an awesome resource regarding Word Press plugins which should be helpful to a great majority of RE.net bloggers. The following information is from a July article on Mashable.com.\u2026","rel":"","context":"In "Technology"","block_context":{"text":"Technology","link":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/category\/technology\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":502,"url":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/502\/bloodhoundblogs-wordpress-plug-ins\/","url_meta":{"origin":11967,"position":3},"title":"BloodhoundBlog’s WordPress plug-ins . . .","author":"Greg Swann","date":"October 3, 2006","format":false,"excerpt":"Daniel Rothamel is swapping over to WordPress, and other people have told me that they are, too, so here, for canonical purposes if for no other, are the WordPress plug-ins BloodhoundBlog is currently using:Akismet Akismet checks your comments against the Akismet web serivce to see if they look like spam\u2026","rel":"","context":"In "Blogging"","block_context":{"text":"Blogging","link":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/category\/blogging\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":10435,"url":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/10435\/weblogging-clients\/","url_meta":{"origin":11967,"position":4},"title":"Weblogging Clients","author":"Damon Chetson","date":"November 25, 2009","format":false,"excerpt":"I'm now writing on a few blogs. BloodHoundBlog, of course. But also my own firm blogs for criminal law and bankruptcy law. All this blogging can get a guy down, especially when you have to use WordPress's web interface. I like the act of writing. I hate the act of\u2026","rel":"","context":"In "Weblogging 101"","block_context":{"text":"Weblogging 101","link":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/category\/weblogging-101\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":3252,"url":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/3252\/wordpress-security-more-important-these-days\/","url_meta":{"origin":11967,"position":5},"title":"WordPress Security – More important these days.","author":"Eric Blackwell","date":"June 22, 2008","format":false,"excerpt":"As in most things...the guy who throws up WP blogs by the dozen is the last guy to check his own. (the cobblers kids have no shoes, et al). Confession Time: EricOnSearch is my blog. It also is my business site. My site disappeared from Google's radar about a week\u2026","rel":"","context":"In "Blogging"","block_context":{"text":"Blogging","link":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/category\/blogging\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-json\/wp\/v2\/posts\/11967","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-json\/wp\/v2\/users\/67"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-json\/wp\/v2\/comments?post=11967"}],"version-history":[{"count":1,"href":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-json\/wp\/v2\/posts\/11967\/revisions"}],"predecessor-version":[{"id":11970,"href":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-json\/wp\/v2\/posts\/11967\/revisions\/11970"}],"wp:attachment":[{"href":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-json\/wp\/v2\/media?parent=11967"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-json\/wp\/v2\/categories?post=11967"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.bloodhoundrealty.com\/BloodhoundBlog\/wp-json\/wp\/v2\/tags?post=11967"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}