Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 2 down vote favorite

I am not sure if it is the correct place to ask such a question. One of my websites got malware. It is hosted on a 1&1 server and the website is developed in WordPress 3.3.1 (now upgraded to 3.5). A few things I noticed are:

  1. A file named "1278bd2dc5f89296044af950a96cd9d0" automatically created in public root directory. If I delete it, it reappear in couple of minutes.
  2. This file has IP address separted by a pipe sign. Every few minutes, a new IP address is added to the list.
  3. Initialy, it also overwrite the index.php and wp-admin/admin.php files with lower permissions. I could not view what the have but I could only delete them.
  4. I SSHed to server and see there are no unknown processes running.
  5. I have one single FTP user. whose password I have changed a while ago.

Can anybody tell me? what and where should I check to stop this happening? May be its remote process. but How to track it down?

Contents at this time are:

157.55.32.83|199.21.99.106|173.255.233.124|

share|improve this question
Those IP addresses look like the IP addresses of your visitors... msnbot, yandex and sucuri.net(?) - so I wouldn't post too many of those on here. So it looks like visitors to your site are perhaps triggering this script. What did this "malware" do? Did it attempt to download something to visitors? – w3d Dec 21 '12 at 17:54
Initially, website was showing ACCESS DENIED error as malware replaced index.php with its own. but website look and work fine. In spite the fact that Google marked is as infected site every time it crawls. – FatalError Dec 21 '12 at 18:01
The "best" malware will not interfere with the normal working of your site (so as not to alert you) but attempt to spread its malicious intent through your site visitors. By logging your site visitors to a publicly accessible file the malware knows where to go next - just my hypothesis. – w3d Dec 21 '12 at 18:11
That is absolutely true, But how can we get rid of it? :-) – FatalError Dec 21 '12 at 18:12

3 Answers

up vote 2 down vote
  1. mark your website as temporary down
  2. rollback to a previous backup (you should have backups from 1&1) that you're sure you weren't infected and you don't loose too much data
  3. upgrade to the latest WP (again)
  4. upgrade any plugins, and remove unnecessary plugins
  5. go online again

good luck!

share|improve this answer
up vote 0 down vote

try this WP plugin http://www.wordfence.com/, though a bit late it can scan your WP files and recommend fixes. I fixed mine manually as well and let wordfence keep running.

share|improve this answer
up vote 0 down vote accepted

At last I found that few index.php files had eval code that was creating and recording visitor's IPs. If someone gets in the same situation, I recommend following flow.

  1. Search for any of the following string in whole of your website.

    • eval(base64_decode
    • eval(gzinflate
    • eval(gzuncompress
    • all above with "echo" instead of "eval".

  2. If step 1 does not work try a more general search

    • eval
    • base64_encode
    • str_rot13
    • edoced_46esab
    • gzinflate
    • gzuncompress

  3. Most probably, the results you will get will contain both good and bad codes. you would then need to identify which one is bad.

  4. Look for the code that is independent, not readable, may be one liner
  5. Delete all occurrence of this code.
  6. Search again for the similar code just to make sure your site is clean now.
  7. Delete files generated by the code.

You can use the thisscript to see what that filthy code does

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.