Alleged malicious code

Whew! Thank god that worked!

Almost there.

I also contacted Pagelines, whose theme I use, and they indicated they had been notified by Sucuri of a vulnerability in the theme I am using but have fixed it. However, attempts to update the theme failed due to an inability to remove the old theme. Worse still, attempting to update the theme causes come kind of crash: as soon as I click on “visit site” after the failed theme update, I get a white screen and “Briefly unavailable for scheduled maintenance. Check back in a minute.)” A few minutes later the site is back again.

Do I have to FTP that too? Do I have to rebuild?

As noted in an earlier post here, when I spoke with Just Host about this problem they advised me to scan via Sucuri. When I did, it returned the notice that the site is infected:

Website Malware malware-entry-mwhjck3123?se1 http://mademers.com/404testpage4525d2fdc

and

Website Malware malware-entry-mwhjck3123?se1 http://mademers.com/404javascript.js.

When one clicks on the View Payload button, this is returned:

Known javascript malware. Details: http://sucuri.net/malware/malware-entry-mwhjck3123?se1
<iframe src=”http://dsnextgen.com/?a_id=106367&domainname=referer_detect&#8221;

When I went to look for the 404testpage4525d2fdc and 404javascript.js files, they did not exist on my site. A call to Just Host also turned up nothing. They told me the iframe bit of code must be embedded in a file somewhere. I went through almost all the files on my website but so far nothing has come up.

Is this familiar at all to you with regards to a vulnerability in WP?

Thanks.

Oh, forgot to ask: How do I check the folder is read/writable in FTP and make sure it is owned by the same process that PHP is running under, typically [my] username.

If I look at my files through my server file manager, every file and folder in my Platform folder has the identical “Perms”: 0555.

Problem solved: the malicious code was found in the 404 folder that my server adds by default. Removing it results in a clean check on Sucuri.

Now I just have to sort out the update theme issue…

Hi James,

Yes, that is what I ended up doing. I went into my site’s file manager and figured out how to change the permissions for the folders, which were set at read and execute only (0555). I then deleted the Platform folder and updated the theme via FTP (only to experience a minor bug in the update, but luckily it was an easy fix).

The permissions for the three main WP folders (admin, content, includes) are now set at 0755, allowing only me, the user, to write. At least that’s what I understand it to mean.

I am curious, though, as to why the WP folders were set to read and execute only (0555). Are the permissions not part of the WP code, or is that a function of my server? Updates prior to 4.1 executed without issue, though I had not updated the themes before. I had no previous knowledge of site folder permissions, and so did not make any changes to my WP folders, earlier or with the update to 4.1.

I have now set the permission for my three WP folders to 0555, so that writing to them is not possible (or so I believe). This doesn’t prevent me from adding anything like media or new posts, at least it didn’t when I tested it. Don’t know if changing the permissions makes my WP sites more secure or not. When it comes times to update again, I will reopen the permissions if this issue reappears.

I also found out what was going on with the 404 code: it was redirecting people to the domain dsnextgen.com, and then on to a site that sells domain names. The owner of dsnextgen.com is Rook Media AG, which runs a monetized domain parking platform. According to one forum post I found from 2011, servers like Just Host make money by redirecting clients’ unmodified 404 pages to advertisements, and that the code to do so (<iframe src=”http://dsnextgen.com/?a_id=106367&domainname=referer_detect&#8221;) is interpreted by sites such as Sucuri as malware. I did find an option to dis/allow ads on my 404 pages, which had been set to allow ads by default (sneaky). Just Host claimed no knowledge whatsoever of this auto-redirection, and said that their 404 code must have been hacked. What bollocks. Nevertheless, deleting this file solved the problem, even though Sucuri initially claimed to have found the same code elsewhere in my WP sites, including on my About page, my Media page, etc.

It is somewhat ironic that an email from Just Host claiming my WP site was infected with a file no one seemed familiar with, and their suggestion that I check my site at Sucuri, resulted in my discovery of Just Host’s use of my 404 page for their commercial gain, which has now been discontinued.

Thank you for all your help. Eventually I got there and all is well again. And I learned a lot of new stuff.

I have no idea what the culprit is, just glad to have it all sorted out. And now I know that when a theme/WP/plugin fails to update, the first thing to check is the permissions on my folders.

I now suspect that the initial email from Just Host about home4/mademer1/public_html/globalindieauthor/wp-includes/js/tinymce/utils/ossdl-cdn.php was either a false positive or an attempt to sell me their site lock: each time I called about this issue, that was the first thing suggested. When I would point out that site lock wouldn’t be much help on a site already allegedly infected, they would agree and suggest I send them $49.00 to clean out the offending code, code that it later turned out they had put in themselves, and bore no relation at all to the WP sites.

So there you have it. I’ve not had reason before to be annoyed with Just Host — they’ve provided good service at a reasonable cost — but this whole 404 thing is really not kosher.