• Resolved siriusly

    (@siriusly)


    Hello —
    Is this actually a malicious file in my root directory, and should I delete it?

    WORDFENCE MESSAGE:
    Filename: ss_installhelper.php
    File Type: Not a core, theme, or plugin file from www.ads-software.com.
    Details: This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is: file_fix_directory(dirname(__FILE__

    The issue type is: Suspicious:PHP/recursivechmod
    Description: May be legitimate file but can be used to put the site in an insecure state

    FILE CODE:

    <?php
    
    if (file_exists('./Home.html')) {
      rename('./Home.html', './Home.html.bak');
    }
    
    file_fix_directory(dirname(__FILE__));
    
    function file_fix_directory($dir, $nomask = array('.', '..')) {
      if (is_dir($dir)) {
         // Try to make each directory world writable.
         if (@chmod($dir, 0755)) {
           echo "<p>Made writable: " . $dir . "</p>";
         }
      }
      if (is_dir($dir) && $handle = opendir($dir)) {
        while (false !== ($file = readdir($handle))) {
          if (!in_array($file, $nomask) && $file[0] != '.') {
            if (is_dir("$dir/$file")) {
              // Recurse into subdirectories
              file_fix_directory("$dir/$file", $nomask);
            }
            else {
              $filename = "$dir/$file";
                // Try to make each file world writable.
                if (@chmod($filename, 0644)) {
                  echo "<p>Made writable: " . $filename . "</p>";
                }
            }
          }
        }
    
        closedir($handle);
      }
    
    }
    
    unlink(__FILE__);
    
    ?>
Viewing 4 replies - 1 through 4 (of 4 total)
  • Hi @siriusly,

    Did you install WordPress on your site with help from Mojo MarketPlace?

    It seems to be one of the files they package with WordPress to fix any directory permissions.

    It’s not malicious, but there is no need for that file to be lurking around anyways.

    Dave

    Thread Starter siriusly

    (@siriusly)

    Thanks for the quick reply! Yes, the site is hosted on BlueHost, so it was likely a MOJO install. I’ll just delete it so I quit getting alerts. Thank you!!

    Thread Starter siriusly

    (@siriusly)

    Thanks again!

    You’re welcome! You can safely delete that file without worry.

    Dave

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Should I delete ss_installhelper.php’ is closed to new replies.