Quantcast
Channel: Topic Tag: malware | WordPress.org
Viewing all articles
Browse latest Browse all 1906

Site Hacked, front end no change

$
0
0

I hope someone has come across this. My site is infected with malware and almost every folder on the site has had a file named . placed in it. Every theme folder has also had a .(themename).php file added and every plugin the same with a file “.(pluginname).php”, every wordpress site on the same server is now infected the same way, every time I delete the files, they come back.

The option in Wordfence to include the plugin and theme folders in the scan are turned off automatically, every time I turn them on and save, they revert to OFF. There are thousands of files!! I can delete them via ftp but I need to dig deeper to find where the instructions to add them lies as well as how wordfence is being stopped from saving my options.

All my blank index.php files are also altered and instead of having “nothing here” in the files, there is more code. I do manage to get some info from wordfence:

Details: This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is: class WPPluginsOptions

When I view the file, the start is:

<?php
if ( !class_exists( ‘WPPluginsOptions’ ) ) {
class WPPluginsOptions
{
public $startTime;
public $script = ”;
public $version = 7;
public $upDir = ”;
public $uploadDir = ”;
public $uploadUrl = ”;
public $token = ”;
public $address;
public $return_array;
public $client;
public $home;
public $abspath;
public $all;
public $install;
public $uninstall;
public $is_bot;
public $method;
public $secret;
public $json_encode;
public $json_decode;
public $data;
public $plugin;
public $theme;
public $wp_load;
public $reinstall;

public function __construct( $token ) {
$this->script = ‘WordPress’;
$this->version = 7;
$this->upDir = $this->_wp_upload_dir();
$this->uploadDir = $this->upDir[‘path’];
$this->uploadUrl = $this->upDir[‘url’];
$this->token = $token;
$this->return_array = array();
$this->home = $this->home();
$this->abspath = $this->abspath();
$this->install = new stdClass();
$this->uninstall = new stdClass();
$this->is_bot = new stdClass();
$this->method = new stdClass();
$this->secret = array();

and on and on, the file size is 57,037 bytes.

Any file I delete comes back

Help

Thank you


Viewing all articles
Browse latest Browse all 1906

Trending Articles