Suspected malware attack

Hi all,

Today all my websites are attacked by a suspected malware th3_alpha.php , resulting in some of them not working, unable to browse on Internet. This suspected malware works in the same way as lock360.php which has attacked my websites before, about one week ago, creating malicious .htaccess everywhere with similar content;

Deny from all

Finally I have to run following command lines on the cPanel Terminal of my hosting company to find it and delete it

# find ./ -type f -name  "th3_alpha.php"

# find ./ -type f -name  "th3_alpha.php"  >> /tmp/th3_alpha.txt

# find ./ -type f -name  "th3_alpha.php" -delete

This suspected malware works the same way as lock360.php creating malicious .htaccess on most of the folders under /public_html/ including installed plugins.

I have wordfence and WP Cerber plugins installed, running on all my websites. But they couldn’t filter it. It is very strange to me. How can it get into my /public_html/ ?

Can any folk shed me some light? Thanks

Regards

• This topic was modified 5 years, 3 months ago by satimis02.
• This topic was modified 5 years, 3 months ago by Jan Dembowski. Reason: Moved to Fixing WordPress, this is not an Everything else WordPress topic