Malware on Shared Hosting with 4 Installations

  • Resolved Adrian M

    (@seitaninstrument)


    6 months, 3 weeks ago

    On my shared hosting account I have 4 installations. I have done the usual: scanned with plugins, reinstalled the core files. I did have backups but they unfortunately had already been infected. I keep deleting and fixing altered files. But it doesn’t seem to stay away. I’ve been fighting this for a month now.

    About the behaviour:
    – on the daily the following files in the root folder are given additional code that point to a .css file (previously .ccss, more about this below): wp-config.php, index.php, wp-settings.php
    – those css files are also generated anywhere within the subfolders. I find them by scanning for their exact names
    – about twice a week or so they additionally create files with more common names such as “options.php”, “profile.php” or “admin.php” that contain obfuscated code and which are also placed anywhere in the subdirectories
    – twice I found radio.txt files all over my shared hosting. The interval was about two weeks.
    – twice I had additional admins which I luckily could delete

    The behaviour suggests a hijacking intention with steps taking place over several days which starts with the first described steps and if you neglect to delete the files it eventually leads further down my list.

    I’ve tried the most popular scanners as well but they don’t detect all the files. Side note to @mmbi18 I even tried your plugin which worked but something weird happened recently, like 1 week ago the behaviour changed: Instead of generating ccss files they have switched to generating the same files with the same kind of code but now as css files. I am not sure how that can happen but I have not had any ccss files since.

    I am hosting all these installations as a favor for friends. At this point I am considering to uninvite them to their own hostings. And I’ve learned to never again host more than one wordpress site per shared hosting. For 4 years nothing happened but it’s taken this one incident with a security issue with one plugin to mess up my whole server. ??

    I have some questions for all the experts here:

    1. does anybody know any kind of malware remover that’s open source? I’ve looked at all the popular ones and it looks like they are about 200 $ per site. I can’t pay this money for now.
    2. Is there a tool that makes it possible to scan all installations locally aka on my windows system?
    3. Is it possible that the malware messes with the “last modified” dates to make it harder to find the files? Also why do folders sometimes say they have been modified recently but then there’s no file that’s changed in that folder? If the modified dates of the folders are not a good indicator to find the changed file within them – what is?
    4. Is it possible that there’s a file creating these files from outside my wordpress installations? Frankly, I am not familiar with the files outside my wordpress installations, they were all just there from the start.
    5. Is there a way to stop my installations from executing the .css (previously .ccss) files from executing as php files? How is this even possible?

    I know these are many questions but besides being in need of help I’m also genuinely curious how these things work. I have been researching it but found many contradictory opinions, and somehow ChatGPT too has given me unsatisfactory vague responds
    ?? Thanks in advance!

Viewing 6 replies - 1 through 6 (of 6 total)
  • Moderator t-p

    (@t-p)

    Carefully follow this guide.

    When you’re done, you may want to implement some (if not all) of the recommended security measures and start backing up your site.

    More useful sources:
    – https://ottopress.com/2009/hacked-wordpress-backdoors/
    – https://www.wpbeginner.com/wp-tutorials/how-to-find-a-backdoor-in-a-hacked-wordpress-site-and-fix-it/
    – https://www.wpbeginner.com/plugins/how-to-scan-your-wordpress-site-for-potentially-malicious-code/
    – Install the plugin Wordfence plugin and.
    – You can also use another scanner: https://www.ads-software.com/plugins/search/malware+database –
    – Also, Scan for “some string” using https://www.ads-software.com/plugins/string-locator/
    – If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Off hand, couple of names that come to mind are Sucuri and Wordfence.

    Thread Starter Adrian M

    (@seitaninstrument)

    The article looks really promising and interesting! Thanks for that, I will read it asap.

    Also thanks for the additional links to useful sources. I have tried all the plugin scanners, they will find some of the infected files but unfortunately none of them (Wordfence, Succuri, MalCare and what have you… I tried all of then) are capable of finding all the files. Like, meanwhile I’m better at finding them manually because I know what to look for. Which doesn’t help because I can’t check every folder, can I?

    However, the string locator could work! I’m excited to try that one.

    in summary: thanks ??

    I will come back to report once I’ve tried it.

    Hey there,

    To tidy things up, if you have SSH access, you can use a Linux command to remove any files that aren’t images, PDFs, or other specified types like webp or SVGs from the uploads folder. Just run something like find /path/to/uploads -type f ! -iname '*.jpg' ! -iname '*.jpeg' ! -iname '*.png' ! -iname '*.gif' ! -iname '*.pdf' ! -iname '*.webp' ! -iname '*.svg' -delete to clean things up. Don’t forget to remove all other folders.

    Once you’re done, be sure to download the latest WordPress files straight from www.ads-software.com.

    Also, remember to use the latest versions of your themes and plugins. Keeping everything up to date helps maintain security and performance.

    Thread Starter Adrian M

    (@seitaninstrument)

    @globaliser thanks so much for your response!

    I don’t have ssh set up but I could. However, I am able to filter all my files by type locally or in the online file manager.

    It’s still so much work for 7 installations to do it like this and I will do it but frankly, I am uncertain if I should put them back on to the same shared server account or if I should just get their own account for each installations because there will always be the risk of this happening again and yes, obviously I will be doing more backups and keep them for even longer than I have but still that means that changes on the website will be lost as I revert to a backup which can be annoying for 7 websites.

    Do people have more than 1 installation per shared server account at all? Or is it bad practice in the first place?

    • This reply was modified 6 months, 2 weeks ago by Adrian M.

    You’re welcome

    When you host all domains under the same account, if one gets infected with malware, the others will be affected as well.

    Consider having a reseller account with your hosting provider, and then set up each account separately. But the default setup with hosting providers is that all domains are under one account if multiple domains are allowed.

    I don’t know how your websites are related, but you might also consider WordPress Multisite. It can save time on updates in terms of management. However, this setup will still be the same as putting all domains on the same account. It only saves time on update management. Additionally, your hosting provider should support WordPress Multisite.

    Thread Starter Adrian M

    (@seitaninstrument)

    The thing is, I was hosting most of the Websites for friends completely for free so moving every one of them to their own hosting kind of defeated the purpose of offering them a free hosting place.

    But my problem seems to have been resolved with installing wordfence once again on each installation. After a few days malware has stopped to appear.

    I keep observing but for now it looks like I’m saved. However, I will eventually move the installations to their own space. Also, maybe the hackers are just making a break and it will start again at some point. ??

    however: thanks to everybody that has given me tipps!

Viewing 6 replies - 1 through 6 (of 6 total)
  • You must be logged in to reply to this topic.

Tags