wp-vcd malware removal.

§ 01 — MECHANISM

It comes in with a nulled plugin and stays for months.

wp-vcd is a long-running WordPress malware family. It almost always arrives bundled with a pirated theme or plugin downloaded from a free-download site. Once on the server it copies itself into every theme on the install and modifies every functions.php to load it on every page request.

Deleting one copy is useless — the others restore it on the next page load. Cleaning it properly means finding every copy at once, removing them together, and breaking the loader that re-installs them.

01 grep -rn 'wp-vcd\|class.plugin.php\|tmpcontentx' \\
02     wp-content/themes/
03
04 // Loader is usually a base64-encoded blob at the top
05 // of functions.php in every theme on the install.

§ 02 — WHAT WE REMOVE

Every copy, every theme.

• [ TRIAGE ]

  Every theme on the install is listed. Each functions.php is compared against the original from the theme vendor.

• [ FILES ]

  wp-vcd.php and class.plugin.php removed from every theme directory at once so they can’t restore each other.

• [ FUNCTIONS.PHP ]

  The injected loader at the top of each theme’s functions.php is removed; the rest of the file is preserved.

• [ BACKDOORS ]

  wp_user accounts created by the malware deleted. Hidden admin users — a wp-vcd signature — purged.

• [ HARDENING ]

  Themes installed from unknown sources flagged. I recommend replacements where the original is unobtainable.

• [ REPORT ]

  Plain-English forensic write-up, source of the infection identified, what to remove before I sign off.

§ PRICE

Flat $279. One-time. Per site.