1

When I browse on my hosting account, I found the index.php of my website has some code embedded to it, in the beginning there was really long line containing erratic code. There was also two more suspicious files I never saw the content of, I will paste the link of each respected files.

  • Code embedded from index.php -- link
  • Another php file -- link
  • Yet another php file (I had to use file sharing service because the file was big) -- link

I already deleted other files which contain some random suspicious looking code. The website was hosted on shared hosting service, is it a marketing website where I advertise my product.

I also saw that the .htaccess file had been modified to include unwanted .php code, when I change it to my original one-- after a minute or so the file kept reverting back to malicious one.

Can you tell me whats the next step for me ? Should I be concerned at this point ? I will gladly post any information you deemed useful. Thanks !

0

It looks like malicious code was inserted in your index.php file. I took a look at the code you posted at https://controlc.com/64190848, and this is obfuscated code. I used unphp.net to de-obfuscate this code. You can see the result at https://www.unphp.net/decode/200752e5c8246fc5472ddc5ab9a3734f/. Clearly, this is malicious code.

As to how this happened - there are a number of possibilities. Your hosting service may have been exploited. Or, one of your PHP scripts (or a component or plug-in that you are using) may have a vulnerability which was exploited.

As to how to recover - hopefully you have copies of your PHP files from before they were exploited, and you can recover from these. Going forward, you may want to host your own site, so that you have more control over your environment. It's inexpensive and simple to setup a LAMP web server on a VPS using Amazon AWS, or another VPS provider. You also might want to take a close look any components or plug-ins that you are using, to be sure that you have the latest versions of these, and that there are no reported vulnerabilities in any of these. Last but not least, once you are back up and running, you might want to run a vulnerability scanner against your site, to see if it finds any vulnerabilities (this may have been what the attacker did, to exploit your site).

4
  • Thanks, does that mean I need to trash the entire website and moving to VPS ?
    – howardy3
    Mar 15 at 1:58
  • 'migrate', not 'trash'.
    – mti2935
    Mar 15 at 10:24
  • Ok, thanks a lot ! I ordered a VPS service immediately.
    – howardy3
    Mar 16 at 1:29
  • Can you tell what the code do and mean? I can't make something of the output it produceds on unphp.
    – howardy3
    Mar 16 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.