my site is infected by malware

  • Resolved thesinglegourmet

    (@thesinglegourmet)


    5 years, 8 months ago

    Hi, there is some malware somewhere in my website that creates 50-70 MB files with the name “core.xxxxx” (where xxxxx is a number) in the /public_html and /public_html/wp-admin directories, on a frequency ranging from 1 per minute to 1 every other second. I am frantically deleting them as they are generated.

    I have identified and removed a modified .htaccess file, as well as some .php files (about.php and admin-ajax.php in /public_html/wp-admin), and I replaced them all with backup copies. There is a process

    /home4/abovethepath/public_html/wp-admin/admin-ajax.php 19005.8% 32.0%

    running, but I replaced the admin-ajax.php file, so… I don’t know what’s going on.

    Is anyone familiar with it and if so, do you know how to remove it?

Viewing 3 replies - 1 through 3 (of 3 total)
  • Thread Starter thesinglegourmet

    (@thesinglegourmet)

    OK, it turned out the admin-ajax.php was taking up CPU time because of something I messed up in the .htaccess file. That has been fixed. But I’m still getting those “core.xxxxx” files, at least a dozen per minute…

    It sounds like a runaway process (e.g it won’t stop on its own). Have you tried killing the process?

    Thread Starter thesinglegourmet

    (@thesinglegourmet)

    It was impossible to find the process that was the culprit; I think it ran a millisecond at a time, or however long it takes to create a file.

    However, with the help of Sucuri, I found all the files that didn’t belong, and once I deleted those, the replication of the garbage files stopped.

    Thanks for responding!

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘my site is infected by malware’ is closed to new replies.

Tags