Malware + File Permission Issue on client website

johir1590r

Member

May 4, 2022

53

4

8

• Nov 6, 2022

• #1

Hello guys. I don't know if this post is suitable here or not. But I need a little help.
And I know here all brilliant WordPress experts/hackers are available.

The problem is: I can't change the file permission from 444 to 644. this problem only with index.php & .htacess And A big malicious code in the index.php

I have Cpanel + WHM Access... When I change the file permission from Cpanel and then edit the file. after that, it automatically returns to 444 file permission with the same code.
I also check the cronjob and deleted everything + scanned with wordfence plugin: the only problem is with index.php & htacess

I would be grateful if you could help me to solve this problem
Thanks

 

xLab

Well-known member

Null Master

Trusted Uploader

Jun 6, 2020

246

671

93

• Nov 6, 2022

• #2

Set the file owner as root.
Then delete the relevant files.

 

• 

Reactions: ukgamer

johir1590r

Member

May 4, 2022

53

4

8

• Nov 6, 2022

• #3

xLab said:

Set the file owner as root.
Then delete the relevant files.

Click to expand...

Can you please, explain a little bit? How I can do this?
I have Cpanel + WHM Access... I was looking for SSH / terminal to run a command. but its not there

 

U

ukgamer

Well-known member

Trusted Uploader

Mar 7, 2019

2,061

1,143

113

EmbedWorld Movie API

embedworld.xyz

• Nov 6, 2022

• #4

Delete the index and htacess , then re-upload clean files

 

johir1590r

Member

May 4, 2022

53

4

8

• Nov 7, 2022

• #5

ukgamer said:

Delete the index and htacess , then re-upload clean files

Click to expand...

I already try it.
After deleting and uploading the fresh file. it automatically returns to 444 file permission with the same code.

 

U

ukgamer

Well-known member

Trusted Uploader

Mar 7, 2019

2,061

1,143

113

EmbedWorld Movie API

embedworld.xyz

• Nov 7, 2022

• #6

johir1590r said:

I already try it.
After deleting and uploading the fresh file. it automatically returns to 444 file permission with the same code.

Click to expand...

then you have a backdoor in the script as well

 

Zer01ne

Well-known member

Mar 21, 2020

1,373

3,428

120

• Nov 7, 2022

• #7

ukgamer said:

then you have a backdoor in the script as well

Click to expand...

Yeah, Think so.

 

M

mml

Well-known member

Trusted Uploader

Dec 4, 2020

575

461

63

FREEDOM

• Nov 7, 2022

• #8

Through the cPanel, upload a clean file and set the rights to 444? Since this is repeated, is there still a reason? Looking for a reason...

Look who is the owner of the file?

 

joAbear

Well-known member

Trusted Seller

Banned User

Dec 23, 2020

1,372

774

113

• Nov 7, 2022

• #9

Code inside index.php regenerates itself. When you delete index.php, code previously in that file still gets executed (it's still loaded in memory). Solution: restart PHP process to unload from memory.

 

• 

Reactions: ukgamer

johir1590r

Member

May 4, 2022

53

4

8

• Nov 7, 2022

• #10

ukgamer said:

then you have a backdoor in the script as well

Click to expand...

Let me tell you what I have done:
From Public_html, I delete everything except the wp-content folder & config.php file
then upload WordPress fresh core files.
Then delete all old themes & plugins & replace them with fresh themes & plugins.
Before uploading them, I checked each item on virustotal.com/

what I can do now? where I'll find the backdoor? function.php is also fresh

 

johir1590r

Member

May 4, 2022

53

4

8

• Nov 7, 2022

• #11

joAbear said:

Code inside index.php regenerates itself. When you delete index.php, code previously in that file still gets executed (it's still loaded in memory). Solution: restart PHP process to unload from memory.

Click to expand...

Thanks, but can you please tell me how I can do it?

 

nevenx

Well-known member

Trusted Uploader

Aug 4, 2018

523

416

63

Mars

hyiptemplates.net

• Nov 7, 2022

• #12

johir1590r said:

Let me tell you what I have done:
From Public_html, I delete everything except the wp-content folder & config.php file
then upload WordPress fresh core files.
Then delete all old themes & plugins & replace them with fresh themes & plugins.
Before uploading them, I checked each item on virustotal.com/

what I can do now? where I'll find the backdoor? function.php is also fresh

Click to expand...

Try to enable hidden files, and after you delete everything see if there are any hidden files with malicious code.

Screenshot

Captured with Lightshot

prnt.sc

It is for sure somewhere in the wp-content folder.

 

• 

Reactions: ukgamer

U

ukgamer

Well-known member

Trusted Uploader

Mar 7, 2019

2,061

1,143

113

EmbedWorld Movie API

embedworld.xyz

• Nov 7, 2022

• #13

johir1590r said:

Thanks, but can you please tell me how I can do it?

Click to expand...

restart the server before re-uploading the new files

johir1590r said:

Let me tell you what I have done:
From Public_html, I delete everything except the wp-content folder & config.php file
then upload WordPress fresh core files.
Then delete all old themes & plugins & replace them with fresh themes & plugins.
Before uploading them, I checked each item on virustotal.com/

what I can do now? where I'll find the backdoor? function.php is also fresh

Click to expand...

if that fails then wipe the server and do a complete fresh install , then just uploading everything after if it happens again then its defo in wp-content folder

 

M

mml

Well-known member

Trusted Uploader

Dec 4, 2020

575

461

63

FREEDOM

• Nov 7, 2022

• #14

database?

 

GrizzlyBear

Active member

Trusted Uploader

Dec 4, 2020

44

108

33

• Nov 7, 2022

• #15

Pretty sure the malware also overwrote some or multiple theme or plugins files to make sure install stays hacked, Very common trick used by hackers to make sure hack is not easily removed.. Have seen it before on many hacked wp installs. Check your themes and plugins. Take a database backup and reinstall plugins if you don't want to spend time locating all modified files. Deleting one file and checking won't help here, as the other copy of hack code, if it was not removed will make new copies again. Wipe wp-content and index together.

 

• 

Reactions: nevenx

U

ukgamer

Well-known member

Trusted Uploader

Mar 7, 2019

2,061

1,143

113

EmbedWorld Movie API

embedworld.xyz

• Nov 7, 2022

• #16

GrizzlyBear said:

Pretty sure the malware also overwrote some or multiple theme or plugins files to make sure install stays hacked, Very common trick used by hackers to make sure hack is not easily removed.. Have seen it before on many hacked wp installs. Check your themes and plugins. Take a database backup and reinstall plugins if you don't want to spend time locating all modified files. Deleting one file and checking won't help here, as the other copy of hack code, if it was not removed will make new copies again. Wipe wp-content and index together.

Click to expand...

like old version of Elementor pro are known for it

 

johir1590r

Member

May 4, 2022

53

4

8

• Nov 7, 2022

• #17

nevenx said:

It is for sure somewhere in the wp-content folder.

Click to expand...

I check everything one by one. Nothing wrong in the wp-content folder.
About themes & plugins files, I replace everything with a fresh one

 

nevenx

Well-known member

Trusted Uploader

Aug 4, 2018

523

416

63

Mars

hyiptemplates.net

• Nov 7, 2022

• #18

johir1590r said:

I check everything one by one. Nothing wrong in the wp-content folder.
About themes & plugins files, I replace everything with a fresh one

Click to expand...

Did you try to scan the site with Ninja scanner and Wordfence plugins?

 

johir1590r

Member

May 4, 2022

53

4

8

• Nov 7, 2022

• #19

nevenx said:

Did you try to scan the site with Ninja scanner and Wordfence plugins?

Click to expand...

Yes. scan with wordfence plugin. problem is with index.php & .htaccess

 

M

mml

Well-known member

Trusted Uploader

Dec 4, 2020

575

461

63

FREEDOM

• Nov 7, 2022

• #20

maybe the problem is elsewhere?
hosting?

what's in the logs?