more info from Wordfence:
A backdoor known as cgok
A backdoor known as 561C
Suspicious eval with a base64_decode
A suspicious code known as eval_exit
Obfuscated code using eval via create_function.
A malicious PHP backdoor
A backdoor known as preg_replace-variant
A backdoor known as SPEEDY-03
A malicious file uploader known as Generic
A backdoor known as n1zb
A backdoor known as Xh33l
Unknown file in WordPress core: wp-includes/js/tinymce/skins/wordpress/simple.php5
Unknown file in WordPress core: wp-includes/rest-api/akismet.php
Unknown file in WordPress core: wp-includes/js/tinymce/themes/modern/wp-console.php
Unknown file in WordPress core: wp-includes/js/tinymce/themes/wp-single.php
Unknown file in WordPress core: wp-includes/js/tinymce/plugins/image/got.php
Unknown file in WordPress core: wp-includes/js/tinymce/plugins/wordpress/newsfired.php
Unknown file in WordPress core: wp-includes/js/tinymce/plugins/fullscreen/sq.php
Unknown file in WordPress core: wp-includes/js/mediaelement/renderers/ex_liner.php
Unknown file in WordPress core: wp-includes/js/codemirror/miniv48.php
Unknown file in WordPress core: wp-includes/css/hello.php
Unknown file in WordPress core: wp-includes/css/newsside.php
Unknown file in WordPress core: wp-admin/sib.php
Hi @josmatic,
It seems like your site has been infected with multiple backdoors.
I would recommend backing up important data on the host, and then completely wiping the document root. Then, you can go about reinstalling WordPress, Wordfence, and then the other plugins you use with WordPress.
The files detected in question were direct matches of known backdoors, so the likelihood of it being a false positive is very low.
Dave
Thank you on answer,
Pretty much we do all of that only did not replace all plugins with new files. My question is: is it database infected!? We find few MYSQL injection for database in suspicion injection or files.
Best regards.
Hi again,
From the log above, I don’t believe your database is infected, however there are various infected files that Wordfence detected.
Dave
Hi wfdave,
Thank you on answer, I did not find anything suspicious in database but after few days I make restore of site before any backdoor action. Setup Wordfence and few additional security parameter.
Once again, thank you.
