2

I just found that one of my wordpress websites included backdoor (my guess).

As I see now, the same file on server is different than original on my laptop drive. So I think my website is already infected. Can you help me clean that up?

Sorry I can't put the code here as I am new and code is big and don't know how to import. You can see it here: Backdoor

Any Help Appreciated!!!

  • If you have a clean backup, restore from that. – Krishna Pandey Nov 18 '17 at 3:40
4

This is knows as Wp-vcd Malware. For full analysis you can check here.

For hardening Wordpress check here, and if you ask yourself, what should you do when your website is hacked - click here.

For removing that particular malware follow this.

More from IBM X-Force Exchange:

Malicious code injection inside a wordpress theme's functions.php and wp-includes editing posts content.

Injected files:

wp-vcd.php
class.wp.php

Edited files:

functions.php
post.php

Analysis

https://medium.com/@cirku17/wp-vcd-malware-analysis-7c5dbaad89c3

Repository

https://github.com/CirKu17/wp-vcd-malware-sample

Keep in mind that this may be updated version of malware, so I didn't go through all the source - my suggestion for you is to backup your website and database from clean backups.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.