There is a new piece of malware affecting WordPress users that is apparently widespread, known as Troj/PHPShll-B. This malicious bit of software likes to embed itself into a WordPress installation and then infect subsequent visitors to the WordPress based website. There is a catch, however – it only affects visitors using Internet Explorer. Or, as we have called it for several years now, Internet Exploder! We’ve advocated the use of alternative browsers, such as Google Chrome, Firefox, and Safari, to our clients, friends, and family for many years now, and this is a prime example of why it is in your best interests to avoid IE. Aside from the security concerns, Internet Explorer does not adhere to web standards, as defined by, oh, you know, the rest of the world, so you can’t be sure that a website developed within an IE environment is going to look great anywhere else. It’s also why folks like us end up pulling our hair out at times to get code that is compliant with web standards to work properly in IE.

So, how can you protect yourself against this malicious code?

• Don’t use Internet Explorer. Tell everyone you know to cut it out, too. Get Google Chrome, Firefox, or Safari. And to answer your question, yes, those can be targeted, too, but they simply aren’t as frequently attacked as IE.
• Use a quality anti-virus/anti-malware product, keep it updated, and run it often. We like Avast** for home use, and Sophos for business use. If you think your computer is infected, and multiple scans within your operating system are not finding anything, allow the anti-virus product to do what is known as  ”boot-time scan” – meaning, it will scan your system before the operating system starts up – when the screen still looks like the old DOS system you may remember from the 1990′s. Let it remove anything it finds.
• If you have a website running WordPress, make sure you are at the latest stable version (3.2.1 as of the time of this writing). Make sure that your login password is complex. (At least 8 characters in length, no dictionary words, a mixture of uppercase and lowercase letters and numbers or better yet, symbols.) Check your site code to make sure nothing malicious has embedded itself. You do not want visitors to your site either being infected, or alerted by their anti-virus that an injection of infected code was attempted by your website. You want to talk about a sudden decline in visitors? That’ll do it for you! If you don’t know how to insure your site’s security, you may need to hire someone qualified to do a health check and correct any problems.
• Keep aware of the threats out there. A great way to do this is by checking the Sophos Naked Security website, becoming a fan of their Facebook page, or following their Twitter account(s).

A check of all of our current client’s websites was made today, and all of those are running the latest stable version of WordPress.  We are hoping that an update to WordPress which addresses this code injection problem is released soon, and we’ll be sure to update all client websites with that code when a stable release is made to insure their security.

If you have any questions or concerns, please don’t hesitate to drop us a line.

**9/20/2011: After hearing some feedback from one of our clients about the latest version of Avast, we can no longer recommend it. However, we can suggest AVG as an alternative.