Strange file and clean header php

plebanek
(@plebanek)

8 years, 4 months ago

Hi
I`ve got two question – maybe someone can help me.
1. Today I sort my files and in the main root of my domain there is appear very strange file name: .htejtbx2.appconfig.php – when I edit it:

<?php header(“HTTP/1.0 404 Not Found”);exit;?>
db-pass= —- here is a pass to my DB
cf-passwd=

is it a normal wordpress or some widget file??

And the second question – This weeke is my first with WP – few years I work on joomla
When I read about a structure of WP files – there was an header.php with a <head> section

I work with SERIOUSLY BUSSINESS THEME from themeforest and there is a file but when I edit it there is only:

<?php header(“HTTP/1.0 404 Not Found”);exit;?>
db-pass=2Qt)0ke7oA
cf-passwd=

and my question where I find a main head section for my template if not in the header.php

sorry if the question isn`t professional – but I start with it so far

Viewing 5 replies - 1 through 5 (of 5 total)

Moderator Steven Stern (sterndata)
(@sterndata)

Volunteer Forum Moderator

8 years, 4 months ago

You’ve probably been hacked.

Install the WordFence plugin. Check the scan options and choose the checkboxes to make an aggressive scan, and then scan your site.

Get a fresh cup of coffee, take a deep breath and carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures.

If you’re unable to clean your site(s) successfully, there are reputable organizations that can clean your sites for you. Sucuri and Wordfence are a couple.

Thread Starter plebanek
(@plebanek)

8 years, 4 months ago

Tarrible!!!

Thanks for Your fast answer.
I remove this file to check if something happend – but the site is fine for me without it

Now I start the scanning like You said by the WordFence
First time it crashed – but I start it the second time and so far everything is ok – I hope that I catched the file fast – and it won`t kill my site.

And what You think about the header.php ? Is it possible that the file look like that.
<div class=”section”>
<div class=”section-content”>
<div class=”container”>

I find it in – wp-content/themes/seriously/header.php – so I thin the path is ok?

Once more thanks a lot for help
bluerain75
(@bluerain75)

8 years, 3 months ago
According to this thread (in Dutch), the file xxxx.appconfig.php is automatically created by some hosters, in order to offer one-click WordPress installation:

https://nl.ww.wp.xz.cn/support/topic/verdacht-appconfigphp-file-ini-de-root/

So according to the above thread, the file would not be the result of a hack.
- This reply was modified 8 years, 3 months ago by bluerain75.
- This reply was modified 8 years, 3 months ago by bluerain75.
Moderator Steven Stern (sterndata)
(@sterndata)

Volunteer Forum Moderator

8 years, 3 months ago

Interesting! Thanks for the link.

eagerbob
(@eagerbob)

7 years, 11 months ago

According to this thread (in Dutch), the file xxxx.appconfig.php is automatically created by some hosters, in order to offer one-click WordPress installation

Correct. if you install WordPress with installatron, you may find some extra files that do not normally belong to a WordPress install:

.xxxxxxxx.appconfig.php
wp-itapi.php (the installatron script)
some backups of files or installs that were on the server before you did the install, like index.html.backup.44fc65b24efc1d7f04bb17697f775632