Malware in /wflogs/attack-data.php?

I have the same email from 1&1. Looks like the “attack” was about 3:36am GMT. Using Wordfence (Free edition)

Same here. Modified files in ‘wflogs’ (poss modified by 1and1) as shown:

* attack-data.php contains this (as shown, which also seems to generate a lot of white data when copied and pasted!):
<?php exit(‘Access denied’); __halt_compiler(); ?>
wfWAF

* config.php has this at the top of what looks like a normal file:
<?php exit(‘Access denied’); __halt_compiler(); ?>

* ips.php has this at the top, with what looks like normal binary code underneath:
<?php exit(‘Access denied’); __halt_compiler(); ?>

* rules.php has this above probable normal code:
<?php
if (!defined(‘WFWAF_VERSION’)) {
exit(‘Access denied’);
}

Hope this helps!
Stevo

Looked at a previous thread & this is the answer from the plugin author

Files are modified when plugins are updated and when plugins perform certain functions. It is normal to see the /wflogs/attack-data.php in that list because that file is updated when your Wordfence Firewall is working.

Possibly just a false alarm?
Had email from client first thing who had email from 1and1.

Also have 2 sites on 1&1 reported same issue. I had to change the permissions from 200 to 644 to download. this is contents:

<?php exit(‘Access denied’); __halt_compiler(); ?>
wfWAF

1and1 already corrected this issue with the non-hacked-wf files. They say that the files can be unlocked by the user in ~3hours (file-permissions back to 604 or anything that works) from now on..

Thanks for the updates guys! If you experience any issues after the Wordfence files in wflogs were on lock down by your host 1&1, just delete the wflogs folder. It will be recreated the next time any page on your site is visited. Note that you will need to go in and set the Firewall back to “Enabled and protecting” as it will default to “Learning mode” when you delete the wflogs folder.

Hope it all works out from here but let us know if it doesn’t.

Thanks wfasa for the very useful plugin! 🙂