3

I am not sure if it is the correct place to ask such a question. One of my websites got malware. It is hosted on a 1&1 server and the website is developed in WordPress 3.3.1 (now upgraded to 3.5). A few things I noticed are:

  1. A file named 1278bd2dc5f89296044af950a96cd9d0 automatically created in public root directory. If I delete it, it reappear in couple of minutes.
  2. This file has IP address separted by a pipe sign. Every few minutes, a new IP address is added to the list.
  3. Initialy, it also overwrite the index.php and wp-admin/admin.php files with lower permissions. I could not view what the have but I could only delete them.
  4. I SSHed to server and see there are no unknown processes running.
  5. I have one single FTP user. whose password I have changed a while ago.

Can anybody tell me? What and where should I check to stop this happening? Maybe it's remote process but how to track it down?

Contents at this time are:

157.55.32.83|199.21.99.106|173.255.233.124|

Improve this question
4
  • Those IP addresses look like the IP addresses of your visitors... msnbot, yandex and sucuri.net(?) - so I wouldn't post too many of those on here. So it looks like visitors to your site are perhaps triggering this script. What did this "malware" do? Did it attempt to download something to visitors?
    – MrWhite
    Dec 21, 2012 at 17:54
  • Initially, website was showing ACCESS DENIED error as malware replaced index.php with its own. but website look and work fine. In spite the fact that Google marked is as infected site every time it crawls.
    – FatalError
    Dec 21, 2012 at 18:01
  • The "best" malware will not interfere with the normal working of your site (so as not to alert you) but attempt to spread its malicious intent through your site visitors. By logging your site visitors to a publicly accessible file the malware knows where to go next - just my hypothesis.
    – MrWhite
    Dec 21, 2012 at 18:11
  • That is absolutely true, But how can we get rid of it? :-)
    – FatalError
    Dec 21, 2012 at 18:12

3 Answers 3

Reset to default
2
  1. Mark your website as temporarily down.
  2. Rollback to a previous backup (you should have backups from 1&1) that you're sure you weren't infected and you don't lose too much data.
  3. Upgrade to the latest WP (again).
  4. Upgrade any plugins, and remove unnecessary plugins.
  5. Go online again.
Improve this answer
0

try this WP plugin http://www.wordfence.com/, though a bit late it can scan your WP files and recommend fixes. I fixed mine manually as well and let wordfence keep running.

Improve this answer
0

At last I found that few index.php files had eval code that was creating and recording visitor's IPs. If someone gets in the same situation, I recommend following flow.

  1. Search for any of the following string in whole of your website.

    • eval(base64_decode
    • eval(gzinflate
    • eval(gzuncompress
    • all above with "echo" instead of "eval".

  2. If step 1 does not work try a more general search

    • eval
    • base64_encode
    • str_rot13
    • edoced_46esab
    • gzinflate
    • gzuncompress

  3. Most probably, the results you will get will contain both good and bad codes. you would then need to identify which one is bad.

  4. Look for the code that is independent, not readable, may be one liner
  5. Delete all occurrence of this code.
  6. Search again for the similar code just to make sure your site is clean now.
  7. Delete files generated by the code.

You can use the thisscript to see what that filthy code does

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.