wp-admin folder create CPR.Webshell everytime

  • mdnadim148

    (@mdnadim148)


    1 year, 7 months ago

    Hello there,
    Ever if I delete everything in the wp-admin folder, there 2 folders remain inside it also the I can’t delete it. Those folder are includes and user. Inside those folders I find the CPR. Webshell in (class-wp.php, class-wp-media-list-data.php and error.php(in user folder)). But when i rename the wp-admin folder then those files cannot be created and i also easily able to delete those files and also the wp-admin renamed files.

    I would be very helpful to know how it’s occurs and how to fix it.

    Thanks in advance

    The page I need help with: [log in to see the link]

Viewing 2 replies - 1 through 2 (of 2 total)
  • Aurimas

    (@auuurimas)

    1 year, 7 months ago

    Hi,

    By the looks of it, it is very likely that your website is injected with malware. The malware clearing process may be a bit complicated, though I am sure you’d manage to clear it by following this guide here: https://sucuri.net/guides/how-to-clean-hacked-wordpress/

    Also, here are some handy tips to keep in mind:

    Why WP websites get malware:

    1. Outdated Plugins.
    2. Outdated Themes.
    3. Unofficial themes or plugins.
    4. Outdated WordPress itself.
    5. Plugins like WP File manager and other plugins that allow reaching web files or databases via WP-ADMIN. Those are vulnerable a lot.

    How to protect your website?

    1. Do not use or download themes or plugins that are Premium but Nulled for free.
    2. Always keep plugins, themes and WordPress up to date.
    3. Have a security plugin (WordFence) installed and scan from time to time. It’s a FREE plugin.
    4. Do not use not popular plugins that have only a few downloads.
    5. Use only the official wordpress.org/plugins page.
    6. If a website doesn’t require user registration, like business websites, I suggest using Hide WP-Admin plugin
    7. If a plugin is not being used – delete it. Even if the plugin is disabled, it can still be used to inject malware.

    • This reply was modified 1 year, 7 months ago by Aurimas.
    Moderator Steven Stern (sterndata)

    (@sterndata)

    Volunteer Forum Moderator

    1 year, 7 months ago

    Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

    If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

Viewing 2 replies - 1 through 2 (of 2 total)
  • The topic ‘wp-admin folder create CPR.Webshell everytime’ is closed to new replies.