kizkot

For those who need help you can contact us here

The solution is on this thread

I found the malware, solution here

I dont know of a program as of yet that can solve this…. it’s purely manual.
I would download all 12 websites do a search amongst the files for all the files starting with “.” Then search for the malware code before re-uploading.

We have a service that can do this if you need help

I’m glad you have it solved

Ohh yes sorry, the config folder was in my theme folder.
im more than happy to have a look at your website if you would like to have a second pair of eyes view it.

• This reply was modified 4 years, 8 months ago by kizkot.
• This reply was modified 4 years, 8 months ago by kizkot.

what i meant by config was simply the wp-config.php in the root directory as it holds the database detail. sorry for any confusion, did you find the same file ?

• This reply was modified 4 years, 8 months ago by kizkot.
• This reply was modified 4 years, 8 months ago by kizkot.

I have found a solution for this on my website…. it has drove me mad all day.

I worked offline with a new wordpress download. my old config which looked fine
and downloaded the rest of my website.
Searched for all files in the plugins and themes directories that started with a dot . and removed all barring the .htaccess which i later inspected manually.
From there i checked my theme folder and found the sneaky bit of code and the malware file.

Within my theme folder there was a a line in the functions.php calling for a file /config/class.php which i found was creating all these new php files.

Deleted the class.php and the line of code in the functions.php and it has gone.

i am now back to normal !

Edit: Here is the code in the functions.php of the theme
“include_once( dirname( __FILE__ ) . ‘/config/class.php’ );”

This may also be held in a plugin file. Hope it helps.

• This reply was modified 4 years, 8 months ago by kizkot.
• This reply was modified 4 years, 8 months ago by kizkot.