: Unknown file automatically created on root folder I am not sure if it is the correct place to ask such a question. One of my websites got malware. It is hosted on a 1&1 server and the

@Cody1181609

At last I found that few index.php files had eval code that was creating and recording visitor's IPs. If someone gets in the same situation, I recommend following flow.


Search for any of the following string in whole of your website.


eval(base64_decode
eval(gzinflate
eval(gzuncompress
all above with "echo" instead of "eval".

If step 1 does not work try a more general search


eval
base64_encode
str_rot13
edoced_46esab
gzinflate
gzuncompress

Most probably, the results you will get will contain both good and bad codes. you would then need to identify which one is bad.
Look for the code that is independent, not readable, may be one liner
Delete all occurrence of this code.
Search again for the similar code just to make sure your site is clean now.
Delete files generated by the code.


You can use the thisscript to see what that filthy code does

Vote Up Vote Down

@Phylliss660

try this WP plugin www.wordfence.com/, though a bit late it can scan your WP files and recommend fixes. I fixed mine manually as well and let wordfence keep running.

Vote Up Vote Down

@Holmes151

Mark your website as temporarily down.
Rollback to a previous backup (you should have backups from 1&1) that you're sure you weren't infected and you don't lose too much data.
Upgrade to the latest WP (again).
Upgrade any plugins, and remove unnecessary plugins.
Go online again.

Vote Up Vote Down