chibijennifer

This issue is finally resolved! In the end, my host (dreamhost) end up finding out the cause. As suspected, it was different to the above mentioned links.

Incase this helps anyone else, this is basically what happened:

———————-

I set-up a script to monitor for the reappearance of the wp-main.php
file (a malicious shell script that keeps coming up no matter how many times you delete). It did appear, exactly on the hour. On a hunch, I
checked your user’s cronjobs.

I found the cause and it was really nasty and clever. The attacker set-up
a cron job that runs hourly to regenerate that file and two others.

They stashed their malicious files in an unused logs directory for a
domain no longer hosted under the user, disguised as outdated
log files. Every hour they copied the “log” files into place. They didn’t
even need to take any action — the cron job handled everything.

———————-

Yeah, I’ve been emailing back and forth with them for weeks now and they haven’t been able to clean it up. It also makes it difficult because every correspondence enquiry is answered by a different tech support person ?? (fyi, I’m using Dreamhost)

Unfortunately, I have already gone through all those links you’ve provided and did everything they have mentioned. Still no fix. Ive been working at this for weeks now and there’s just no solution..

Help anyone? Please.. I just deleted off my entire site again today, and uplaoded a fresh new wordpress, plugins, themes..everything. 2 hours later, the hacked file is sitting there all over again……………

wp-main.php

Yeah, it comes out clean but I’m 100% sure it’s not clean…

Unfortunately..the hack is still there despite deleting the whole theme ??

There’s a wp-main.php file that keeps reappearing despite deleting it several times. The file contains the below code:

[ Please do NOT post 1,362 lines of malware code again. ]

ah…! You might be right! I’m going to delete the theme now…

Just wondering, how did you find out it was the theme causing the issue? I looked at all the code and it looked fine.

Thanks very much for the replies! Hopefully this will do the trick.

I have the exact same problem as torakiki ?? I’ve worked at it for almost 40 hours now and still can’t find a resolution. I’ve even replaced the entire installation of wordpress, started from scratch, deleted all plugin and themes and downloaded fresh copies. Still not resolved. Malicious files keep being re-added and I’m totally out of ideas.

Help?
My site: https://moonsticks.org

Google: site:moonsticks.org drugs

yea..it sometimes randomly works on some machines, but most of the time it still doesn’t work, and only loads to a page which says “Error: This file cannot be used on its own.”

I have the same problem with my new blog:

https://tvb.windy-goddess.net

I’m having the same trouble with my blog, but I can’t figure it out..

EDIT: No worries, I figured it out =D Thanks for your time!!

How do we view it in ‘single’ mode?