I’m also seeing this on a hosting place that has several WP installs. Cleaning them up (removing files that aren’t supposed to be there, removing code) hasn’t fixed things yet, it keeps coming back.
If you want to decode strings like that, use the https://www.unphp.net site. Use the recursive check button.
I’ve found bad code in wp-settings.php, wp-config.php, index.php, ico files (that start with a dot to make them hidden), random-name.php, rouge 500.php files inside the WP installs, and non-WP sites.
Not sure where the re-infection is coming from. Have reset credentials everywhere (hosting, ftp, WP users, etc) to no avail.
I think there might be some code inside the wp-posts table. Today’s task is to look for that.
For your code, it evaluates (via the www.unphp.net site) to this; other infected files have the same eval of the obfusticated code:
<?php ?><div style="clear: both"></div>
</div>
<div id="foot">
<a href="https://wordpress.stackexchange.com/questions/350833/<?php bloginfo("url'); ?>">Home</a><?php $pages = wp_list_pages('depth=1&title_li=&echo=0');
$pages2 = preg_split('/(<li[^>]*>)/', $pages);
foreach ($pages2 as $var) {
echo str_replace('</li>', '', $var);
} ?> <br/>
Distributed by <a href="http://mondaydressing.com">Baju Grosiran</a><br/>
<?php wp_footer(); ?>
<?php $header_ads_act = get_theme_option('footer_ads_act1');
if (($header_ads_act == '') || ($header_ads_act == 'No')) { ?>
Copyright © <?php echo date("Y") ?> <a href="https://wordpress.stackexchange.com/questions/350833/<?php bloginfo("url'); ?>"><?php bloginfo('name'); ?></a><?php
} else { ?><?php echo get_theme_option('footer_ads1'); ?><?php
} ?>
</div>
</div>
</body>
</html><?
Still analyzing; will add to this answer as I find out more.
Added
The ‘ico’ files with a dot in front contain PHP code that also evaluates to the above code. There are @include commands in the modified files that point to those ico file so that the code inside will be executed.
Added 19 Oct 2019 630pm PST
Notices that there are many files, mostly index.php, that have permissions of ‘execute’ (755). That is an indicator of the file containing some obfusticated code (decoded via the site linked above).
Some of the decoded strings will point to the malware’d ICO file.
But all of the encoded strings decode to the above code.
Did find a couple of draft posts with author number ‘0’ in one of the WP sites. But no indication of the malware’s entry point yet.
Added 20 Oct 2019
Still have not found the source of the code insertions. I can clean the entire site (I think) and files are re-attacked the next day.
I’ve done all of the standard things, to no avail.
I’m building a program that will scan all files and look for files that may have been hacked; perhaps I am missing some.
The problem is made more complex by the server (dedicated VPS server at a hosting place) having multiple sites, WP and non-WP. All sites are being affected, with files randomly placed throughout all folders.
I’ll figure this one out. Luckily, the sites are low-traffic. But it is not feasible to do a ‘nuke’. I’ll keep reporting here…
Added 24 Oct 2019
I’ve written a program that helps me identify possible hacked files based on their content. Not a true ‘anti-virus’ thing, but a good (IMHO) program to identify areas of concerns.
If you (or anyone else) interested, please contact me on my https://www.securitydawg.com site.
Added 11 Nov 2019
Site is still getting modified. The wp-settings/wp-config files, adding of the hidden ico files, random-named php files, and modified index.php (including index.php files where they shouldn’t be).
Additional things done (in addition to above):
- Change permissions of the wp-config.php and wp-settings.php to 400 or
- Change the password of the WP database(s) to something very strong.
- Look at the wp-posts table for wp-content fields that are not normal
(like just a bunch of random numbers). Delete those entries. They
will most likely be towards the end of the table, but look at every
row.
We shall see how that works.