Title: Malign Code Injected Into ALL .php Files
Last modified: August 21, 2016

---

# Malign Code Injected Into ALL .php Files

 *  Resolved [andersbalari](https://wordpress.org/support/users/andersbalari/)
 * (@andersbalari)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/malign-code-injected-into-all-php-files/)
 * A few days ago the webhosting agency locked down one of my websites, due to a
   security issue they came across during a scan.
 * I’m now analyzing and trying to repair the installation. So far each .php file
   I checked seems to be affected, also within all themes and plugins.
 * The injection appears to consist of several php statements at the very beginning
   of each file, some seemingly endless long variables, an explode statement and
   so forth. Further, the date of last change as shown in my FTP-Client is unchanged
   for each file.
 * I’ve searched the web and the forums for similar cases but didn’t find anything.
 * Two other sites of mine were also down (“white screen of death”) – however, they
   were hosted somewhere else and just restoring the backup of one week ago did 
   the trick; I didn’t check the filesystem of these websites, so I don’t know if
   it was the same problem.
 * Now, for the website in question, the webhosting agency only keeps the last three
   daily backups and thus unfortunately I wasn’t able to solve this with restoring
   a backup.
 * So I’m required to manually renew the whole installation, including the themes
   and plugins.
 * Has anyone also encountered this issue/attack? How did you handle it?
 * Thanks and cheers
    Anders

Viewing 8 replies - 1 through 8 (of 8 total)

 *  Moderator [Ipstenu (Mika Epstein)](https://wordpress.org/support/users/ipstenu/)
 * (@ipstenu)
 * 🏳️‍🌈 Advisor and Activist
 * [11 years, 10 months ago](https://wordpress.org/support/topic/malign-code-injected-into-all-php-files/#post-5117676)
 * You need to start working your way through these resources:
    [http://codex.wordpress.org/FAQ_My_site_was_hacked](http://codex.wordpress.org/FAQ_My_site_was_hacked)
   [http://wordpress.org/support/topic/268083#post-1065779](http://wordpress.org/support/topic/268083#post-1065779)
   [http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/](http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/)
   [http://ottopress.com/2009/hacked-wordpress-backdoors/](http://ottopress.com/2009/hacked-wordpress-backdoors/)
   Additional Resources:
 * [http://sitecheck.sucuri.net/scanner/](http://sitecheck.sucuri.net/scanner/)
   
   [http://www.unmaskparasites.com/](http://www.unmaskparasites.com/) [http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html](http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html)
 *  [eldoradoseo](https://wordpress.org/support/users/eldoradoseo/)
 * (@eldoradoseo)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/malign-code-injected-into-all-php-files/#post-5117833)
 * I have the same issue. It happened last Thursday and has really got me down. 
   My backups are infected as well.
 * Sucuri doesn’t find it in the scan and I find no references to it online.
 *  [eldoradoseo](https://wordpress.org/support/users/eldoradoseo/)
 * (@eldoradoseo)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/malign-code-injected-into-all-php-files/#post-5117834)
 * Has anyone found a somewhat painless solution to this?
 *  Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * (@jdembowski)
 * Forum Moderator and Brute Squad
 * [11 years, 10 months ago](https://wordpress.org/support/topic/malign-code-injected-into-all-php-files/#post-5117837)
 * I’m sorry but there really is no shortcut to this. The links posted above can
   get you started on cleaning up your installation.
 *  [UseShots](https://wordpress.org/support/users/useshots/)
 * (@useshots)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/malign-code-injected-into-all-php-files/#post-5117844)
 * Do you mean this [http://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.html](http://blog.sucuri.net/2014/07/malware-infection-breaking-wordpress-sites.html)?
 * This buggy malware corrupts lots of PHP files. The only good way to recover a
   site is to restore it from a clean backup or reinstall WordPress and all themes
   and plugins. And by the way, it installs a rogue admin user that has no name –
   it should be deleted.
 *  [eldoradoseo](https://wordpress.org/support/users/eldoradoseo/)
 * (@eldoradoseo)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/malign-code-injected-into-all-php-files/#post-5117864)
 * What I have used and seems to work somewhat painlessly is this.
 * 1: Backup infected site mysql db and complete site.
    2: Make list of all plugins
   themes. 3: Delete all files. 4: Clean up php files in theme by removing malware
   in beginning of each file. 5: Reinstall WordPress. 6: Edit config file to point
   to original db. 7: Install Wordfence plugin to protect against malware. 8: Install
   theme. 9: Install other plugins.
 * This was my site. It was completely toasted. So far it seems secure.
 * There are still some issues to fix but 90% of the site is good and that is huge.
   🙂 I learned a valuable lesson. I had been backing up weekly but allowing my 
   backup software to overwrite my file each week to save space. Big no no. My last
   backup was infected because I didn’t realize I had been hacked until after the
   last backup.
 *  Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * (@jdembowski)
 * Forum Moderator and Brute Squad
 * [11 years, 10 months ago](https://wordpress.org/support/topic/malign-code-injected-into-all-php-files/#post-5117869)
 * > 1: Backup infected site mysql db and complete site.
   >  2: Make list of all plugins
   > themes. 3: Delete all files.
 * I think you forgot step “3a: Delete the directories too.” as there is often hidden
   files that contain exploits as well. Deleting the directories as well improves
   the chances of getting those to but make sure your backup is good first.
 *  Thread Starter [andersbalari](https://wordpress.org/support/users/andersbalari/)
 * (@andersbalari)
 * [11 years, 10 months ago](https://wordpress.org/support/topic/malign-code-injected-into-all-php-files/#post-5117874)
 * Thanks for your replies!
 * I already had proceeded very similar to the process eldoradoseo has outlined.
 * Manually cleansing all the custom .php-files for which I didn’t have an appropriate
   backup really was a pain in the a…
 * The site is up and running again.
 * As I use security plugins (WordFence on one of the attacked sites, which could
   be repaired with simply restoring the backup file; and the successor of “Better
   WP Security” on the other two sites that were affected) I think the attacks might
   have been successful only due to a security leak in the “MailPoet” plugin – the
   developers had sent a warning in a timely manner, however, I didn’t find time
   to update to the fix they provided until it was too late. Thus: Mea culpa.

Viewing 8 replies - 1 through 8 (of 8 total)

The topic ‘Malign Code Injected Into ALL .php Files’ is closed to new replies.

 * In: [Everything else WordPress](https://wordpress.org/support/forum/miscellaneous/)
 * 8 replies
 * 5 participants
 * Last reply from: [andersbalari](https://wordpress.org/support/users/andersbalari/)
 * Last activity: [11 years, 10 months ago](https://wordpress.org/support/topic/malign-code-injected-into-all-php-files/#post-5117874)
 * Status: resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics