Gootloader infection cleaned up

Dear blog owner and visitors,

This blog had been infected to serve up Gootloader malware to Google search victims, via a common tactic known as SEO (Search Engine Optimization) poisioning. Your blog was serving up 295 malicious pages. Your blogged served up malware to 0 visitors.

I tried my best to clean up the infection, but I would do the following:

  • Upgrade WordPress to the latest version (one way the attackers might have gained access to your server)
  • Upgrade all WordPress themes to the latest versions (another way the attackers might have gained access to your server)
  • Upgrade all WordPress plugins (another way the attackers might have gained access to your server), and remove any unnecessary plugins.
  • Verify all users are valid (in case the attackers left a backup account, to get back in)
  • Change all passwords (for WordPress accounts, FTP, SSH, database, etc.) and keys. This is probably how the attackers got in, as they are known to brute force weak passwords
  • Run antivirus scans on your server
  • Block these IPs (5.8.18.7 and 89.238.176.151), either in your firewall, .htaccess file, or in your /etc/hosts file, as these are the attackers command and control servers, which send malicious commands for your blog to execute
  • Check cronjobs (both server and WordPress), aka scheduled tasks. This is a common method that an attacker will use to get back in. If you are not sure, what this is, Google it
  • Consider wiping the server completly, as you do not know how deep the infection is. If you decide not to, I recommend installing some security plugins for WordPress, to try and scan for any remaining malicious files. Integrity Checker, WordPress Core Integrity Checker, Sucuri Security,
    and Wordfence Security, all do some level of detection, but not 100% guaranteed
  • Go through the process for Google to recrawl your site, to remove the malcious links (to see what malicious pages there were, Go to Google and search site:your_site.com agreement)
  • Check subdomains, to see if they were infected as well
  • Check file permissions

Gootloader (previously Gootkit) malware has been around since 2014, and is used to initally infect a system, and then sell that access off to other attackers, who then usually deploy additional malware, to include ransomware and banking trojans. By cleaning up your blog, it will make a dent in how they infect victims. PLEASE try to keep it up-to-date and secure, so this does not happen again.

Sincerly,

The Internet Janitor

Below are some links to research/further explaination on Gootloader:

https://news.sophos.com/en-us/2021/03/01/gootloader-expands-its-payload-delivery-options/

https://news.sophos.com/en-us/2021/08/12/gootloaders-mothership-controls-malicious-content/

https://www.richinfante.com/2020/04/12/reverse-engineering-dolly-wordpress-malware

https://blog.sucuri.net/2018/12/clever-seo-spam-injection.html

This messageRelated: find exponential function from two points calculator, does lil wayne have cancer 2021, town of clay garbage pickup schedule, which formation is one feature of karst topography brainly, st clair country club pittsburgh membership fees, how to remove sauder twist lock fastener, bernie liverpool actor, acton blink s2 battery replacement, tucson baseball camps 2021, lindsay jones pronouns, lab puppies lakeland fl, what happened to shanshan feng, motherlode cheat sims 4 xbox one not working, ehrling bergquist medical records, death notices kingston, ny,Related: ryan’s equipment grapple saw, idaho falls chukars roster, fatal accident quakertown, pa, safest neighborhoods in rochester, ny, what happens when you mix vaseline and toothpaste together, detroit tigers star wars night 2021, , steve liesman wife, nebraska football coaching staff salaries, kodai capital management, potato of love penzeys, lincoln city f c players wages, cod cold war is bell stalin’s grandson, duke football coaching staff, east shore travel league baseball schedule,Related: the lincoln highway: a novel, naics code for llc any legal purpose, invisiplug net worth 2020, southland city church problems, , holly hill raleigh nc visiting hours, rife machine cancer testimonials, hilary duff house in houston, the greatest showman jr script, coleman funeral home ackerman, ms obituaries, town of epsom nh tax maps, pbr illinois 2022 rankings, does live with kelly and ryan have an audience, semi truck accident missouri yesterday, louisville, ms arrests,Related: state of florida monthly pay schedule 2021, swot table on silver airways, what is tartarus in percy jackson, why do f1 drivers drink from straw after race, steel is an alloy containing fe atoms and c atoms, stone brewery mac and cheese recipe, water temperature in lakes, how to access my wawa hub from home, springdale ar radio stations, dichterliebe roman numeral analysis, pearland softball association, how to recharge a flair disposable, most educated person in zimbabwe, improbable student challenge, my deodorant makes my armpits hurt,Related: inisha fowler kenneka jenkins, kenwood country club membership cost, fred poe katie douglas wedding, ingredients in baby cereal, houses to rent in hull dss welcome no guarantor, what religion was johnny carson, kevin steele beaumont, funny cricket commentary holding willey, capita asymulator angry snowboarder, who played miss lemon’s sister in hickory dickory dock, apartment for rent las vegas strip, furnished studio apartments for rent in kuwait, logan banner indictments 2022, strengths of incapacitation, renault arkana ambient light,Related: st bonaventure rugby player dies, brake and battery light on nissan murano, mobile homes rent riverside, ca, mark fisher death golden gate bridge, anita carter obituary, , catskill police blotter, julie goodyear son gary, tlc lars contact, homes for rent by owner new lenox, il, does minute maid fruit punch have caffeine, crystal bever survivor, available 3 letter tiktok usernames, roger martin obituary, anthem prior authorization list 2022,Related: lamar county football staff, sunderland medical school admissions statistics, town and country club st paul membership cost, the newtown bee police reports, bottomless brunch market harborough, hamilton county circuit court judges, jodie pick up lines, moral arguments of health and safety, james baker sons, oakham school vacancies, kohler to napa filter cross reference, list of doctrines in contract law, why did jeff francoeur retire, creekside church tampa, corgi mix for adoption new york,Related: things you hold in your hand, sam lovegrove motorcycles cornwall, lil baby height, big pack skin slendytubbies, rr mcreynolds company, llc, wrestlemania los angeles 2022, onto itself or unto itself, joe kennedy iii president 2024, will a 5 mph over ticket affect insurance, 3 ingredient peach cobbler without cake mix, youth conference gatlinburg, tn, 1960 guatemala female names, president james dean monument mythos, custom 35 inch spare tire cover, risk of rain 2 legendary tier list,Related: car ferry from st thomas to st john, what time can corner shops sell alcohol, george karl wife, buttery taste in mouth pancreatic cancer, friday cheers 2022 lynchburg va, george barris auction, what happened to gianni paolo, ipswich hospital eye clinic map, ligonier events this weekend, dr crane phalloplasty results, kwik trip nature’s touch ice cream flavors, what is the mole ratio of nh3 to o2, spring branch high school alumni, marriage is not for everyone bible verse, shooting in boone county, ky today,Related: mary lou retton daughters, h1b lottery results 2022 latest news, michael dempsey obituary, ohio high school football player rankings, ikos dassia room service menu, 1970 buick skylark, nathan george obituary, addenbrooke’s uniform policy, is pickled herring good for diabetics, lululemon pricing strategy, icon golf cart charging issues, mark simone wife, the benefits of integration of ai to dss include, alaska airlines a321 business class, albion sword scabbards,Related: feeding america value of donated food, sierra middle school bell schedule, similarities between snail and octopus, david duplissey net worth, breaking news sunbury, pa, folgers pants commercial cast, john townsend obituary, how to beat the windfall elimination provision, little bastard muzzle brake 300 win mag, the lakeside collection catalog, what to say when someone says you’re overthinking, sbr college football forum, bishop mcallister ame church, mt wilson nevada ranch, villa park high school famous alumni,Related: literary character costumes, kirby funeral home henagar, al, did russell poole shoot rafael perez, nhs maternity pay calculator 2022, was peter sellers married to elke sommer, davada dee stanley, homes for rent alger county, mi, air force technical sergeant shelly kelly, irregular shapes names and pictures, how much does tom selleck get paid for commercials, rarest personality type female in order, where does bad bunny live now, how to remote start mercedes 2021, tina jones comprehensive assessment quizlet, ,Related: traverse city state hospital cemetery, bacchanal buffet military discount, coors field home run distance, how many years in secondary school uk, 7 swords of st michael prayer, blue sea kale & pure coconut water mousse, ortur offline controller, is tajae sharpe related to shannon sharpe, the little catholic jewelry, power bi scheduled refresh greyed out, metal work classes near me, mike morse house huntington woods, charles melton phil melton, how to straighten a bent car antenna, how to jump in gorescript,Related: , margot kim social media san jose, is white dove a good color for kitchen cabinets, , giant skeletons found, joe garratt sandwich business, 13952113d4b4aedfa2be580ff small cafe to rent london, shooting in dudley today, richard sheridan ann sheridan, ftb phillies scout team 2025, guatemalan actors in hollywood, hyundai tucson commercial actress 2021, clairemont high school famous alumni, mini moet rose bottles 6 pack, mark cooper obituary,Related: fresno unified substitute pay schedule, john handley high school yearbook, washington state jury duty age exemption, who is hosting cbs this morning today, ballet white vs swiss coffee, ellison house brookview liberty pine, can you drive from glacier national park to banff, is witchcraft illegal in arizona, eddie v’s wine list, does a new roof qualify for bonus depreciation, court reporter salary in orange county ca, golden west middle school yearbook, what female has the most grammys, the langford apartments detroit, mi, tensor double dot product calculator,Related: once upon a prince 2, 2022 pheasant forecast, suburgatory cast member dies, has michael corrado jackson been married before, tractor supply greenville, pa, go section 8 baltimore city county, stetson original after shave lotion with aloe, what religion is nick schifrin, halal rooftop restaurants london, michael mcclain missing found, countess franca rota borghini baldovinetti, dirk mcmahon house, reichsadler vs parteiadler, julia campbell princeton, mal de gorge extinction de voix covid,Related: lakota slang words, who is the girl in somethin’ ’bout a truck video, aron diggs, what happened to inpixon, how do i get a fertilizer license in florida, how to get a camera account in minecraft multiplayer, what does ga3 mean on ticketmaster, highest attendance in soccer, gamitin sa pangungusap ang magpanggap, henry mountbatten, earl of medina, what year did chris powell have a heart attack, spike lee speech impediment, st lukes hospital maumee trauma level, mri tech said, good luck, russian equipment losses in ukraine so far,Related: jason antoon eye condition, heather cox richardson round pond maine, heidi vanderveer partner, victoria state election results, societal and economic benefits of entrepreneurship, do hospitals have strike insurance, is there school on columbus day in illinois, pirate treasure never found, name ‘col’ is not defined pyspark, is juwan howard a member of kappa alpha psi, how many times can 8 go into 2, henry garza wife, john pinette funeral pictures, has letitia dean lost weight recently, eagle mountain polygamy,Related: jones bbq sauce net worth 2020, gci newspapers customer service, champva pharmacy fax number, typescript cannot use namespace as a type, iowa total care cgm coverage, defame crossword clue 7 letters, why did fans not like catherine rollins, ammianus marcellinus the luxury of the rich in rome summary, bloodline trust pdf, mrs miniver bloopers, lake quivira country club membership cost, riverside police scanner frequencies, maui concerts december 2022, funny captions for tongue sticking out, rhea seehorn broken arm,Related: what happened to eva mendes clothing line, aws bottlerocket vs firecracker, contra costa county permit portal, hiroyuki terada cameraman charles preston, circumcision recovery photos, seal team 1 vietnam roster, jesse friedman chime, virginia tech secret society, golden 1 center seating chart with rows, bcg scar hurts years later, st francis of assisi incline village, the world tarot how someone feels about you, pineapple plant leaves drooping, my boyfriend texts a girl he used to like, cerebral amyloid angiopathy related inflammation,Related: atwater village crime, stones associated with freya, princess rail dining menu, the of a neuron contain ________ that house neurotransmitters, cruise line auditions musical theatre, feed bunk neck rail height, lakeside bar and grill, poynette, wi menu, power bi matrix column total, les journalistes femmes de france 24, kent police court cases, liu athletics staff directory, declan ryan ryanair wife, simchart post case quiz 89, dave’s hot chicken nutrition information, roasted chicken with carrots, celery and onions,