Title: Malware from wp-count.php Last modified: August 20, 2016 --- # Malware from wp-count.php * [cosmocatalano](https://wordpress.org/support/users/cosmocatalano/) * (@cosmocatalano) * [13 years, 10 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/) * Received a malware notification from Google Webmaster tools yesterday for my cycling blog, [http://cyclocosm.com](http://cyclocosm.com), informing me that one post and two index pages (yearly for 2012, monthly for June 2012) were putting malware on visiting computers from 3rd-party URLs. * Reading through the malware report, it became evident that a file called **wp- count.php** was serving up JS downloads to users on page load. wp-count.php wasn’t part of a relatively clean WP install I had on a different site, and reading the contents of the file, it began “This file is protected by copyright law and provided under license. Reverse engineering of this file is strictly prohibited”— obviously, something was up. * I Googled** “wp-count.php” **and found some mentions of malware attacks, but no real fixes. Twitter search just pulled up this post in Japanese: [http://twitter.com/strive/status/217218845251870722](http://twitter.com/strive/status/217218845251870722) * The site was still on 3.4, so I updated to 3.4.1 and tried deleting and renaming wp-count.php, but it immediately reappeared. The next step I took was to **delete the contents of the file, and replace them with a single “0”**. So far this seems to have worked. Google has re-scanned the site and given it a clean bill of health. * I don’t have complete control over my site hosting, so I’m talking with my admin about reinstalling from a previous version, and then reposting the updates I’d made since then. * Anyone else encountering/encountered a similar issue? Viewing 15 replies - 1 through 15 (of 23 total) 1 [2](https://wordpress.org/support/topic/malware-from-wp-countphp/page/2/?output_format=md) [→](https://wordpress.org/support/topic/malware-from-wp-countphp/page/2/?output_format=md) * [s_ha_dum](https://wordpress.org/support/users/apljdi/) * (@apljdi) * [13 years, 10 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2862878) * > The site was still on 3.4, so I updated to 3.4.1 and tried deleting and renaming > wp-count.php, but it immediately reappeared. * If wp-count.php comes back after you delete wp-count.php I suspect that the real problem is elsewhere– another .php file or possibly an application on your server that is checking for the presence of wp-count.php and putting it back if you delete it. Filling in the ‘0’ seems to have tricked it, but I would worry that the infection is still there and you don’t know what else it can do. Reinstalling, as you seem to be planning, would be prudent. * Thread Starter [cosmocatalano](https://wordpress.org/support/users/cosmocatalano/) * (@cosmocatalano) * [13 years, 10 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2862940) * No ambiguity here—reinstall is the desired solution. But like I said, it’s not entirely within my ability to do so at the moment. * I had some more time to look around today and found a **wp-apps.php** file that was pretty much the same as wp-count.php. Googling that brought up [this forum post](http://www.webhostingtalk.com/archive/index.php/t-1134572.html) which mentions a wp-configure.php (which I didn’t have) doing similar things. * I deleted wp-apps.php and my modified wp-count.php, and neither has returned since, so I’m breathing *slightly* easier. Still going to reinstall. * [s_ha_dum](https://wordpress.org/support/users/apljdi/) * (@apljdi) * [13 years, 10 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2862960) * I don’t know if you need to re-install a previous version, just a clean one. Your database would be the only real worry– a rogue admin user, for example. * [violaine12](https://wordpress.org/support/users/violaine12/) * (@violaine12) * [13 years, 10 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863060) * I have exactly the same malware infection and the wp-count.php reappears just like you said. * I am noooo techie at all but in my google webmaster acount I also got this information. * suspected malware injected code: * `` * What can I do with this? * Thanks * Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/) * (@jdembowski) * Forum Moderator and Brute Squad * [13 years, 10 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863061) * **[@violaine12](https://wordpress.org/support/users/violaine12/)**, Unless you are on the same server, with the same plugins, theme, versions, etc. _OR you have the solution for cosmocatalano… _ * Please start your own topic. * [jellis05](https://wordpress.org/support/users/jellis05/) * (@jellis05) * [13 years, 9 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863065) * Has anybody had an success in determining where these files are coming from? I have found that they are being included in the footer.php and page_home.php files located in my themes directory. * [perezbox](https://wordpress.org/support/users/perezbox/) * (@perezbox) * [13 years, 9 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863066) * Hey All, * Sounds like a backdoor is still being left on the server, for the newbs you might want to check out this post as it gives you some advice on what you can and can’t remove and how: [http://sucuri.net/website-malware-removal-wordpress-tips-tricks.html](http://sucuri.net/website-malware-removal-wordpress-tips-tricks.html) * For those suffering from the same issue, I’d recommend opening that wp-count. php or wp-apps.php and try grepping the rest of your server for the same content. Some times you’ll have the same payload using different file names. * If you pastebin the payload I’ll be happy to take a look see if we have it in our definitions somewhere. * Cheers. * [preetindersodhi](https://wordpress.org/support/users/preetindersodhi/) * (@preetindersodhi) * [13 years, 7 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863077) * Does anyone has more information about this Malware, specific information? * I keep getting the same malware again and again. I’m running the latest version of WordPress. What do I do to get rid of it for good? * [violaine12](https://wordpress.org/support/users/violaine12/) * (@violaine12) * [13 years, 7 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863078) * He Some guy, * It is a nasty thing but I have found a perfect free plugin which will take care of it. I was soo glad I found this one. I have installed it on all my websites and is called “wordfence”. Works awesome * [kmessinger](https://wordpress.org/support/users/kmessinger/) * (@kmessinger) * [13 years, 7 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863079) * Talk to your host. * You also need to start working your way through these resources: [http://wordpress.org/support/topic/268083#post-1065779](http://wordpress.org/support/topic/268083#post-1065779) [http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/](http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/) [http://ottopress.com/2009/hacked-wordpress-backdoors/](http://ottopress.com/2009/hacked-wordpress-backdoors/) * Additional Resources: [http://sitecheck.sucuri.net/scanner/](http://sitecheck.sucuri.net/scanner/) [http://www.unmaskparasites.com/](http://www.unmaskparasites.com/) [http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html](http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html) * [violaine12](https://wordpress.org/support/users/violaine12/) * (@violaine12) * [13 years, 7 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863080) * Talking to bluehost did not work for me though. They left me completely in the dark as far as help to get rid of it. Just a few resources with theory which a normal guy would not understand at all 🙂 * [perezbox](https://wordpress.org/support/users/perezbox/) * (@perezbox) * [13 years, 7 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863081) * Hi Violaine12 * Count20 can be a pretty persistent bugger. Here is something you want to try: * In terminal, try grepping for all count20.php instances: * grep -ri ‘count20.php’ . * The reason I say that is if you’re using an online scanner it might be pulling up the JS files, but more often than not you’ll find it in the index files as well. You want to be sure to remove all instances. Too often folks will remove the index instances or the JS instances, but not both. * The other thing you want to do is kill php execution in your uploads directory and wp-includes. You can try it in your theme directory, but some themes area bit finicky. * Also, I would take some time to go into your bluehost cpanel and download both your error and access logs – raw logs. * Not sure what all you have done, but seems that you might want to do some investigation to see what the source is, I’d be willing to bet its some kind of compromised credential. * Thanks * [violaine12](https://wordpress.org/support/users/violaine12/) * (@violaine12) * [13 years, 7 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863082) * Hi perezbox, * Thanks for your help! * Luckily the plugin “wordfence” did remove all files! It is not only a scanner but also removes stuff. The malware did not return last 2 months. * Vio * [Amaryder](https://wordpress.org/support/users/amaryder/) * (@amaryder) * [13 years, 7 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863088) * [@cosmocatalano](https://wordpress.org/support/users/cosmocatalano/) i am getting the same Malware for my website its 3rd time i got attacked, feeling frustrated to recover again and again have you got any solution broo please help me. * I found both file wp-count and wp-app which are not included by wordpress i think reply me soon. * thanks! * [perezbox](https://wordpress.org/support/users/perezbox/) * (@perezbox) * [13 years, 7 months ago](https://wordpress.org/support/topic/malware-from-wp-countphp/#post-2863089) * Hi * Hard to give any advise without knowing the peculiars of what you have or haven’t done. * Thanks Viewing 15 replies - 1 through 15 (of 23 total) 1 [2](https://wordpress.org/support/topic/malware-from-wp-countphp/page/2/?output_format=md) [→](https://wordpress.org/support/topic/malware-from-wp-countphp/page/2/?output_format=md) The topic ‘Malware from wp-count.php’ is closed to new replies. ## Tags * [compromised site](https://wordpress.org/support/topic-tag/compromised-site/) * [javascript](https://wordpress.org/support/topic-tag/javascript/) * [page load](https://wordpress.org/support/topic-tag/page-load/) * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/) * 23 replies * 13 participants * Last reply from: [esmi](https://wordpress.org/support/users/esmi/) * Last activity: [13 years ago](https://wordpress.org/support/topic/malware-from-wp-countphp/page/2/#post-2863121) * Status: not resolved ## Topics ### Topics with no replies ### Non-support topics ### Resolved topics ### Unresolved topics ### All topics