Title: Alleged malicious code
Last modified: August 22, 2016

---

# Alleged malicious code

 *  Resolved [Bad_Egg](https://wordpress.org/support/users/bad_egg/)
 * (@bad_egg)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/)
 * Got this a few days ago from my host:
 * This notice is to inform you that we have detected malicious code in your website
   files. We have compiled a list of compromised files on your account, as well 
   as the code injected, below.
 * In order to maintain a secure hosting environment, we will be automatically correcting
   these compromised files on your account; however, please be aware that you are
   responsible for verifying that the content hosted within your account is secure.
   We strongly advise that you update your installed scripts and software, as outdated
   scripts and software are the most frequently used method for accessing and gaining
   control of a targeted account.
 * If you need assistance updating the software on your hosting account, please 
   do not hesitate to contact our Support department.
 * The compromised files detected are:
 * /home4/mademer1/public_html/globalindieauthor/wp-includes/js/tinymce/utils/ossdl-
   cdn.php
 * The malicious code detected is similar to:
 * Files with the following contents or MD5SUMs, which contain malicious code:
    \
   $default_action\s*=\s*[‘”]FilesMan[‘”]\s*
 * When I check the directory, the ossdl-cdn.php is absent. So I cannot tell if 
   my host removed it because “we will be automatically correcting these compromised
   files on your account” or because the files are hidden.
 * I have looked this up and there are several examples of the same warning from
   one’s host provider but each time the alleged offending file is different.
 * Any ideas as to how I can verify and remove this code?
 * Thanks.

Viewing 15 replies - 16 through 30 (of 36 total)

[←](https://wordpress.org/support/topic/alleged-malicious-code/?output_format=md)
[1](https://wordpress.org/support/topic/alleged-malicious-code/?output_format=md)
2 [3](https://wordpress.org/support/topic/alleged-malicious-code/page/3/?output_format=md)
[→](https://wordpress.org/support/topic/alleged-malicious-code/page/3/?output_format=md)

 *  Thread Starter [Bad_Egg](https://wordpress.org/support/users/bad_egg/)
 * (@bad_egg)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757230)
 * Whew! Thank god that worked!
 * Almost there.
 * I also contacted Pagelines, whose theme I use, and they indicated they had been
   notified by Sucuri of a vulnerability in the theme I am using but have fixed 
   it. However, attempts to update the theme failed due to an inability to remove
   the old theme. Worse still, attempting to update the theme causes come kind of
   crash: as soon as I click on “visit site” after the failed theme update, I get
   a white screen and “**Briefly unavailable for scheduled maintenance. Check back
   in a minute.**)” A few minutes later the site is back again.
 * Do I have to FTP that too? Do I have to rebuild?
 * As noted in an earlier post here, when I spoke with Just Host about this problem
   they advised me to scan via Sucuri. When I did, it returned the notice that the
   site is infected:
 * > Website Malware malware-entry-mwhjck3123?se1 [http://mademers.com/404testpage4525d2fdc](http://mademers.com/404testpage4525d2fdc)
 * and
 * > Website Malware malware-entry-mwhjck3123?se1 [http://mademers.com/404javascript.js](http://mademers.com/404javascript.js).
 * When one clicks on the View Payload button, this is returned:
 * >  Known javascript malware. Details: [http://sucuri.net/malware/malware-entry-mwhjck3123?se1](http://sucuri.net/malware/malware-entry-mwhjck3123?se1)
   > 
   > <iframe src=”[http://dsnextgen.com/?a_id=106367&domainname=referer_detect&#8221](http://dsnextgen.com/?a_id=106367&domainname=referer_detect&#8221);
 * When I went to look for the 404testpage4525d2fdc and 404javascript.js files, 
   they did not exist on my site. A call to Just Host also turned up nothing. They
   told me the iframe bit of code must be embedded in a file somewhere. I went through
   almost all the files on my website but so far nothing has come up.
 * Is this familiar at all to you with regards to a vulnerability in WP?
 * Thanks.
 *  Moderator [James Huff](https://wordpress.org/support/users/macmanx/)
 * (@macmanx)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757232)
 * I’d recommend getting in touch with Pagelines about that. As volunteers, we don’t
   have access to their paid products to see why it isn’t working right.
 *  [Simon Prosser](https://wordpress.org/support/users/pross/)
 * (@pross)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757242)
 * Hi James, she has contacted PageLines. I’ll post the reply here so at least she
   might read it on one of the forums.
    [http://forum.pagelines.com/topic/38153-host-says-website-is-infected/](http://forum.pagelines.com/topic/38153-host-says-website-is-infected/)
 * The URL she is putting into the security scanner is *not* running WordPress and*
   is* infected.
 * She has WordPress running in a folder, /globalindieauthor/ its WordPress 4.1 
   running a very old version of Platform theme.
 * To the OP, you cannot simply upload a theme in WordPress admin and expect it 
   to update the theme, you either let WordPress update the theme itself, if its
   configured right you will get an update, or download the theme manually, unzip
   it and upload the new files into the theme folder via FTP.
    Here is the theme
   page: [https://wordpress.org/themes/platform](https://wordpress.org/themes/platform)
 *  Thread Starter [Bad_Egg](https://wordpress.org/support/users/bad_egg/)
 * (@bad_egg)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757246)
 * Hi Simon,
 * I *am* trying to update the theme from within WordPress itself. I updated WP 
   first, then I tried to update the theme. WP begins the update but then it fails
   due to an inability of WP to remove the old theme (and then I get that weird “
   Site down for maintenance” message before everything resets itself without any
   input from me). I haven’t reconfigured WP in any way, so if it is not “configured
   right” that was not my doing.
 * The reason I am asking whether or not the infection could be within one of my
   WP sites (I have three) is that I have checked every single file in my main site
   and cannot find this alleged malicious code. I have not yet gone through every
   single WP and Pagelines file (I got about halfway done), and was hoping that,
   since WP have released updates to deal with vulnerabilities, then James might
   recognize the malicious code and have an idea of where I should look.
 * Meanwhile, Pagelines was contacted by Sucuri about a vulnerability in Platform,
   and Pagelines produced a patch, so I assume Pagelines would know the likely nature
   of the suspect files and where they might be lurking, which is why I also posted
   this on the Pagelines site.
 * I see no need for your condescension, Simon. I have been posting/reading on both
   forums trying to get to the bottom of this.
 *  [Simon Prosser](https://wordpress.org/support/users/pross/)
 * (@pross)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757247)
 * I wasn’t being condescending.
 * If WordPress cannot delete the old theme folder then it probably does not have
   permissions. Check the folder is read/writable in FTP and make sure it is owned
   by the same process that PHP is running under, typically your username.
 * I know PageLines produced a patch, i wrote it 😉
 * The patch closed a vulnerability in platform. It did not have anything to do 
   with suspect files in your non WordPress root folder im afraid.
 *  Thread Starter [Bad_Egg](https://wordpress.org/support/users/bad_egg/)
 * (@bad_egg)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757251)
 * I think I discovered at least part of the problem. I didn’t realize I could set
   Sucuri to look only at the WP folders, and another WP site of mine is infected
   with the exact came code, in what are otherwise identical files:
 * [http://www.mademers.com/badegg](http://www.mademers.com/badegg)
    [http://www.mademers.com/badegg/404testpage4525d2fdc](http://www.mademers.com/badegg/404testpage4525d2fdc)
   [http://www.mademers.com/badegg/404javascript.js](http://www.mademers.com/badegg/404javascript.js)
   [http://www.mademers.com/badegg/404javascript.js](http://www.mademers.com/badegg/404javascript.js)
 * This site is running one of the WP default themes. Unfortunately, I now cannot
   log into the site for some reason so I cannot specify which WP theme it is running.
 * Cleaning out /globalindieauthor and replacing it via FTP seems to have sorted
   out that WP site; will now do the same with this older one and see if that works.
   If not, I will delete the WP site.
 * The third site is uninfected. Go figure.
 *  Thread Starter [Bad_Egg](https://wordpress.org/support/users/bad_egg/)
 * (@bad_egg)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757252)
 * Oh, forgot to ask: How do I check the folder is read/writable in FTP and make
   sure it is owned by the same process that PHP is running under, typically [my]
   username.
 * If I look at my files through my server file manager, every file and folder in
   my Platform folder has the identical “Perms”: 0555.
 *  Thread Starter [Bad_Egg](https://wordpress.org/support/users/bad_egg/)
 * (@bad_egg)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757253)
 * Okay, I am beginning to think this whole exercise is suspect: I accidentally 
   typed in “mademers.com/badegg” instead of “mademers.com/bad_egg” and Sucuri found
   the first one infected. Incredible considering the site does not exist.
 * I only thing I can think of is that my server’s 404 page is infected. Is that
   possible? Because that is all one gets when one types in “mademers.com/badegg”.
 *  Thread Starter [Bad_Egg](https://wordpress.org/support/users/bad_egg/)
 * (@bad_egg)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757254)
 * Problem solved: the malicious code was found in the 404 folder that my server
   adds by default. Removing it results in a clean check on Sucuri.
 * Now I just have to sort out the update theme issue…
 *  Moderator [James Huff](https://wordpress.org/support/users/macmanx/)
 * (@macmanx)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757256)
 * I believe Pagelines has its own updater. Are you using that, or the updater at
   Dashboard -> Updates?
 *  [Simon Prosser](https://wordpress.org/support/users/pross/)
 * (@pross)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757257)
 * > I believe Pagelines has its own updater.
 * It does, for its own commercial versions. _Bad\_Egg_ has the WordPress dot org
   version of the theme installed.
 *  Moderator [James Huff](https://wordpress.org/support/users/macmanx/)
 * (@macmanx)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757258)
 * Ah, thanks for confirming!
 * Bad_Egg, I suspect this is indeed a permissions issue. Access your server via
   [FTP or SFTP](https://codex.wordpress.org/FTP_Clients), navigate to `/wp-content/
   themes/` download a copy of the `/pagelines/` directory to your computer as a
   backup, and delete the `/pagelines/` directory from the server.
 * Then, re-install the theme by adding it via Appearance -> Themes -> Add New in
   your blog’s Dashboard. This will both give you a current updated copy of the 
   theme, and should fix the permissions issue going forward. (if WordPress can 
   install the theme, it can update the theme)
 *  Thread Starter [Bad_Egg](https://wordpress.org/support/users/bad_egg/)
 * (@bad_egg)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757262)
 * Hi James,
 * Yes, that is what I ended up doing. I went into my site’s file manager and figured
   out how to change the permissions for the folders, which were set at read and
   execute only (0555). I then deleted the Platform folder and updated the theme
   via FTP (only to experience a minor bug in the update, but luckily it was an 
   easy fix).
 * The permissions for the three main WP folders (admin, content, includes) are 
   now set at 0755, allowing only me, the user, to write. At least that’s what I
   understand it to mean.
 * I am curious, though, as to why the WP folders were set to read and execute only(
   0555). Are the permissions not part of the WP code, or is that a function of 
   my server? Updates prior to 4.1 executed without issue, though I had not updated
   the themes before. I had no previous knowledge of site folder permissions, and
   so did not make any changes to my WP folders, earlier or with the update to 4.1.
 * I have now set the permission for my three WP folders to 0555, so that writing
   to them is not possible (or so I believe). This doesn’t prevent me from adding
   anything like media or new posts, at least it didn’t when I tested it. Don’t 
   know if changing the permissions makes my WP sites more secure or not. When it
   comes times to update again, I will reopen the permissions if this issue reappears.
 * I also found out what was going on with the 404 code: it was redirecting people
   to the domain dsnextgen.com, and then on to a site that sells domain names. The
   owner of dsnextgen.com is Rook Media AG, which runs a monetized domain parking
   platform. According to one forum post I found from 2011, servers like Just Host
   make money by redirecting clients’ unmodified 404 pages to advertisements, and
   that the code to do so (<iframe src=”[http://dsnextgen.com/?a_id=106367&domainname=referer_detect&#8221](http://dsnextgen.com/?a_id=106367&domainname=referer_detect&#8221);)
   is interpreted by sites such as Sucuri as malware. I did find an option to dis/
   allow ads on my 404 pages, which had been set to allow ads by default (sneaky).
   Just Host claimed no knowledge whatsoever of this auto-redirection, and said 
   that their 404 code must have been hacked. What bollocks. Nevertheless, deleting
   this file solved the problem, even though Sucuri initially claimed to have found
   the same code elsewhere in my WP sites, including on my About page, my Media 
   page, etc.
 * It is somewhat ironic that an email from Just Host claiming my WP site was infected
   with a file no one seemed familiar with, and their suggestion that I check my
   site at Sucuri, resulted in my discovery of Just Host’s use of my 404 page for
   their commercial gain, which has now been discontinued.
 * Thank you for all your help. Eventually I got there and all is well again. And
   I learned a lot of new stuff.
 *  Moderator [James Huff](https://wordpress.org/support/users/macmanx/)
 * (@macmanx)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757263)
 * WordPress should definitely not have set itself to 555. Files should be at least
   644, and directories should be at least 755.
 * Maybe your FTP client or server overwrote the permissions.
 *  Thread Starter [Bad_Egg](https://wordpress.org/support/users/bad_egg/)
 * (@bad_egg)
 * [11 years, 6 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/2/#post-5757272)
 * I have no idea what the culprit is, just glad to have it all sorted out. And 
   now I know that when a theme/WP/plugin fails to update, the first thing to check
   is the permissions on my folders.
 * I now suspect that the initial email from Just Host about home4/mademer1/public_html/
   globalindieauthor/wp-includes/js/tinymce/utils/ossdl-cdn.php was either a false
   positive or an attempt to sell me their site lock: each time I called about this
   issue, that was the first thing suggested. When I would point out that site lock
   wouldn’t be much help on a site already allegedly infected, they would agree 
   and suggest I send them $49.00 to clean out the offending code, code that it 
   later turned out they had put in themselves, and bore no relation at all to the
   WP sites.
 * So there you have it. I’ve not had reason before to be annoyed with Just Host—
   they’ve provided good service at a reasonable cost — but this whole 404 thing
   is really not kosher.

Viewing 15 replies - 16 through 30 (of 36 total)

[←](https://wordpress.org/support/topic/alleged-malicious-code/?output_format=md)
[1](https://wordpress.org/support/topic/alleged-malicious-code/?output_format=md)
2 [3](https://wordpress.org/support/topic/alleged-malicious-code/page/3/?output_format=md)
[→](https://wordpress.org/support/topic/alleged-malicious-code/page/3/?output_format=md)

The topic ‘Alleged malicious code’ is closed to new replies.

## Tags

 * [remove](https://wordpress.org/support/topic-tag/remove/)

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 36 replies
 * 5 participants
 * Last reply from: [stbedesantafe](https://wordpress.org/support/users/stbedesantafe/)
 * Last activity: [11 years, 4 months ago](https://wordpress.org/support/topic/alleged-malicious-code/page/3/#post-5757366)
 * Status: resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics