Reply to thread

Message

<blockquote data-quote="jamesdowallen" data-source="post: 827137" data-attributes="member: 81356">UPDATE:&nbsp; My host admin pointed me to another malware file.&nbsp; I logged in to look around ... and immediately found that the index.phtm hijack had been reinstalled just a few hours ago!&nbsp; Still pointing to scott/spinner.gif.&nbsp; So I&#039;ve removed that file.&nbsp; (Email me at Gmail to see its contents.)The two different malware php scripts were different, but Googling their encrypted code led me to some answers.&nbsp; Below see the strings I searched for and some of the Google hits.CQ9jnUNtDTIlpz9lK3WypT9lqTyhMluSK0IFHx9FXGgNnJ5cK3AyqPtaMTympTkurI9ypaWipaZaYPqCMzLaXGgN&nbsp;&nbsp; <a href="https://www.getastra.com/e/malware/infections/japanese-backdoor-wordpress-hack" target="_blank">Japanese Backdoor WordPress Hack | Astra Website Security</a>basename(trim(preg_replace(rawurldecode(&quot;%2F%5C%28.%2A%24%2F&quot;)[URL unfurl=&quot;true&quot;]https://blog.manchestergreyhats.co.uk/2018/11/07/php-malware-examination/[/URL][URL unfurl=&quot;true&quot;]https://www.masswerk.at/nowgobang/2019/anatomy-of-a-wp-backdoor[/URL]How do they get in?&nbsp; Just now I used another machine to change my passwords ...</blockquote>

[QUOTE="jamesdowallen, post: 827137, member: 81356"] UPDATE: My host admin pointed me to another malware file. I logged in to look around ... and immediately found that the index.phtm hijack had been reinstalled just a few hours ago! Still pointing to scott/spinner.gif. So I've removed that file. (Email me at Gmail to see its contents.) The two different malware php scripts were different, but Googling their encrypted code led me to some answers. Below see the strings I searched for and some of the Google hits. CQ9jnUNtDTIlpz9lK3WypT9lqTyhMluSK0IFHx9FXGgNnJ5cK3AyqPtaMTympTkurI9ypaWipaZaYPqCMzLaXGgN [URL="https://www.getastra.com/e/malware/infections/japanese-backdoor-wordpress-hack"]Japanese Backdoor WordPress Hack | Astra Website Security[/URL] basename(trim(preg_replace(rawurldecode("%2F%5C%28.%2A%24%2F") [URL unfurl="true"]https://blog.manchestergreyhats.co.uk/2018/11/07/php-malware-examination/[/URL] [URL unfurl="true"]https://www.masswerk.at/nowgobang/2019/anatomy-of-a-wp-backdoor[/URL] How do they get in? Just now I used another machine to change my passwords ... [/QUOTE]

Verification