Wordfence Rules.php malware injection

  • Resolved nevsie

    (@nevsie)


    2 years, 3 months ago

    Hi,
    I know this is not Wordfences direct fault, and I know this is not coming from wordfence.
    However, at some point malware is being injected into the rules.php file in the wflogs folder.

    I have downloaded a copy of the file, removed it, and then when it gets re-added, the same happens, eventually.
    My guess is a plugin, or other source is injecting it.

    My questions is – where do I go from here to identify it?
    Is this of use to WF for their own reference!
    etc.

    Thanks, N

Viewing 3 replies - 1 through 3 (of 3 total)
  • Plugin Support wfpeter

    (@wfpeter)

    Hi @nevsie, thanks for contacting us.

    We do have a signature specifically for rules.php becoming infected, which is possibly what you’ve seen here. However, after deleting it we’ll create a new (clean) version of the file so if it’s being reinfected repeatedly it does point towards another infection somewhere. If you share a hosting account with other sites it might be cross-infection, or you may need to clean your site. I’ll provide instructions for how to get started.

    Follow the checklist here: https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/

    Make sure to get all your plugins and themes updated and update WordPress core too. If you are on an older branch (WordPress 4.x etc) because you wanted to wait before installing the latest version because of Gutenberg or a custom theme compatibility you still need the latest update in that version. Those can be found here:
    https://www.ads-software.com/download/releases/
    WordPress sometimes patches their older releases if they find a vulnerability so make sure to update your version if needed. We, of course, recommend that you update to the latest version.

    As a rule, any time I think someone’s site has been compromised I also tell them to update their passwords for their hosting control panel, FTP, WordPress admin users, and database. Make sure to do this.

    Additionally you might find the WordPress Malware Removal section in our free Learning Center helpful.

    If you are unable to clean this on your own there are paid services that will do it for you. Wordfence offers one and there are others. Regardless if you choose to clean it yourself or let someone else do so, we recommend that you make a full backup of the site beforehand.

    Thanks,

    Peter.

    Thread Starter nevsie

    (@nevsie)

    Okay.
    I know how to go through and clean…

    I was just under the impression you might be interested in the injection and potential source for the future. If you are not, then I will go ahead and delete and clean site.

    Plugin Support wfpeter

    (@wfpeter)

    Hi @nevsie,

    Thank-you, apologies if I misunderstood. A signature does exist for the file, but it’s not guaranteed to be the same, so we accept infected file submissions to samples @ wordfence . com.

    Please note that when making files available to us, ensure that you remove any database access credentials or keys/salts contained inside before sending.

    Thanks again,

    Peter.

Viewing 3 replies - 1 through 3 (of 3 total)
  • The topic ‘Wordfence Rules.php malware injection’ is closed to new replies.

Tags