0

Two years ago I've built a small Wordpress site for a friend of mine, and some weeks ago I got a warning mail from my ISP, about a worldwide attack to Joomla, Wordpress... (well, more or less, it was italian, of course). I had no idea what to do, and nothing seemed to happen. Two days ago, browsing to that site I got a message from my browser (Firefox), about possible malware being detected on my site.

I think I've found something to clear, namely a .htaccess under /public_html directory, containing only:

RewriteBase /
RewriteEngine on

Well, I can browse that and then I can delete it. But there is also a skript.php that I can't inspect - and then neither delete - insufficient permission.

EDIT: Now I found also that in wp-admin there is an images.php that also I can't inspect, and an .htaccess containing the redirection to the site Google was advising against.

I'm using FTP now to check the site, because cpanel (accessed of course with the browser) also give the warning. It's safe to use cpanel? I can't see other way to clean up my site.

| improve this question | |
  • 2
    Its time to nuke the server and load everything from scratch. – Ramhound May 6 '13 at 10:33
1

Probably there is also some security issue with the Wordpress setup, being it two years old maybe it's time to apply security patches. if you don't want (or can't) rebuild the server from scratch, I sould suggest to:

  1. check the date/time of creation of the file images.php as this is probably when the whole site got corrupted
  2. find all .php files created/modified that day at that time
  3. restore/delete all those files
  4. browse your site with malware detection antivirus (kaspersky has good engine for trojans)
  5. if virus/trojan is detected find the virus signature: really not that difficult, since they're usually javascript based, so with Firebug you can track them easily
  6. check for that signature in filesystem and database
  7. delete/restore records/files affected by that virus

If you have got a linux server the thing seems more difficult than it actually is, done this work lately, and a whole Wordpress site was cleaned in a couple of hours.

| improve this answer | |
  • Thank you for your help. I ended up cleaning manually, after logging with cpanel I actually had the rights to do. And then changed the passwords, well, these that I can, and updated to last Wordpress 3.6.1 (but I was already up-to-date, I had 3.6). But actually I'm unsure if any of these are effective. If they cracked the password assigned to me by the Hoster, I can't do anything, apart manually checking - by now - and requested my Hoster to assign me a new - main - password. – CapelliC May 7 '13 at 9:14
  • oops... actually was Wordpress 3.5, I updated to 3.5.1 – CapelliC May 7 '13 at 9:28
  • 1
    one hint: did you, by chance, uploaded the site with FTP after developing locally? in case maybe you missed to upload .htaccess on some folders and they were able toupload custom .php files and execute them: double check for all .htaccess files in subfolders because this is a step that many people miss to check and leads to huge troubles. Beside this: if you just managed to delete some files wia web your site is still unsafe, this kind of attack needs console work done. try to browse the site via a internet antivirus software to double check it. – user1555320 May 7 '13 at 9:28
  • actually I did. It's .htaccess necessary to lock unwanted uploading ? I'm not aware of this. – CapelliC May 7 '13 at 9:32
  • .htaccess is often used to forbid .php execution in subfolders. making a long story short: * uploaded files must go on a folder owned by www-data [apache must have rights to write there] * if your code is insecure and you [or your CMS] don't check for uploaded files, i can upload a .php file instead of a .jpg file * this means that if i point that file with a browser, that file is actually executed, and if this php is a mini-file browser, i have access to all files in my www-root anc can mess all your site * having .htacces with a proper statement keeps you safe from this scenario * to – user1555320 May 7 '13 at 9:56
2

Format your server and restore from a backup that was created before the infection.

Whoever got in to your website could have done anything they wanted, there is no way to be 100% sure you removed everything they did to your server without doing a full wipe and restoring from a backup.

| improve this answer | |
  • Of course I don't have access to format, it's a virtual directory hosted on a Apache2 server – CapelliC May 6 '13 at 10:22
  • 3
    @CapelliC - Ask your hosting provider to nuke the directory then. Somebody has the access to nuke the directory. – Ramhound May 6 '13 at 10:34
2

Somebody (probably some bot) got access to your Wordpress installation and exploited a vulnerability in WP or in one of the plugins. I think your friend has not kept WP and its plugins up-to-date (sin #1 in the Wordpress world, or is that not having backups?).

Assuming that you do not have full control over your web server, the best you can do is:
[If you have full control, wipe the entire server and restore from backup]

  • Download uploaded files (e.g. the picture directory) through FTP

  • Download the database contents

  • Wipe the entire Wordpress installation

  • Delete the database and recreate a new one

  • Install the latest version of WP and the required plugins

  • Upload database contents and pictures

For filling in these specific task you'd have to Google how to do that.

Alternatively, if you cannot backup/restore your data, you'll have to rewrite all your WP post from scratch. But whatever you do, wipe the entire WP installation, because you don't want any malware PHP files in its directories (and you have no way of knowing which are the bad ones among so many files).

Additional note: their is still one vulnerability in this approach: your database contents may be contaminated as well. Not with executable scripts, but there may be traces left e.g. a mention of an installed 'bad' plugin. So going through the database locally to look for anything suspicious is recommended before uploading it back.

| improve this answer | |
  • Yes, I've backupped locally all the files and the database. But I can't wipe Wordpress directories because there are those damn .php with permissions higher than my FTP account. – CapelliC May 6 '13 at 10:29
  • Who set up WP then? Ask them – Jan Doggen May 6 '13 at 11:16
  • I've setup the site, using FTP access. But those scripts are unreadable using my FTP account. – CapelliC May 6 '13 at 11:35
  • Then do as Ramhound told you – Jan Doggen May 6 '13 at 11:37
0

If you can't access to some files or folders, I would recommend you to change the file permissions.

When your site is blacklisted/removed from search results, Google recommends webmasters to take their site down as soon as possible, to contact their web hoster and then to change all passwords for all users and all accounts. https://support.google.com/webmasters/bin/answer.py?hl=en&answer=163634

The last step is to ask Google to review your site:

  1. On the Webmaster Tools Home page
  2. Select the site you want.
  3. Click Health, and then click Malware.
  4. Click Request a review.
| improve this answer | |
  • Yes, I read the support pages from Google, and BTW I decided to use cpanel to wipe the files. Now I'm waiting to see an updated report from Webmaster tools. Thank you for your help. – CapelliC May 6 '13 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.