17 {{ upvoteCount | shortNum }}
17 {{ upvoteCount | shortNum }}

Is this Malware code?

by Jupitor
15 replies
Google has identified my sites as having Malware. I am trying to find where the code is. Can anyone tell me if all of this in an .htaccess file is malicious code? Thanks!
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
<Files 403.shtml>
order allow,deny
allow from all
</Files>
deny from 83.103.119.239
deny from 80.83.210.250
deny from 69.90.162.100
deny from 193.105.240.173
deny from 80.243.174.25
deny from 174.37.182.234
deny from 69.125.222.180
#code #malware
  • Profile picture of the author Earnie Boyd
    No it isn't. Everything there looks fine to me. Usually you'll find javascript redirecting to a site or pulling information from a site which is what Google is picking up on.
    Signature
    Earnie Boyd
    {{ DiscussionBoard.errors[6111121].message }}
  • Profile picture of the author Blackhat Articles
    this is your .htaccess file's contents. check index.php or footer.php in your current wordpress theme. you can also check your website at sucuri dot net.
    {{ DiscussionBoard.errors[6111440].message }}
  • Profile picture of the author GFI
    Well, I don't think so that it is a malware virus, do you have any viruses in your PC? Or you upload things from your computer on your site?
    {{ DiscussionBoard.errors[6111481].message }}
    • Profile picture of the author BlueLayerHost
      That's definitely not malware. How about providing a link to the site so we can look and see?
      Signature
      BlueLayerHost - Shared + Managed VPS Hosting
      BlueLayerMedia - Web Development
      WPMalware - Resource for WordPress Seurity + Exploits
      {{ DiscussionBoard.errors[6113562].message }}
  • Profile picture of the author IdeaBox
    If you're using a nulled/cracked CSM/Forum/Blog software, chances are theirs a phishing site embedded somewhere.
    {{ DiscussionBoard.errors[6121209].message }}
  • Profile picture of the author paparts
    check your scripts. Some injects js on it and redirects it on a malware infected site
    {{ DiscussionBoard.errors[6123773].message }}
  • Profile picture of the author n7 Studios
    The approach to take with this is:

    1. Download a copy of your web site files
    2. Search through all of the files using a text editor or similar for any of the following words:
    eval
    base64
    <script

    3. Look at every match that appears, and if any of them have what appear to be 'garbled' or non-readable code e.g. a lot of random letters, numbers and symbols, then it's likely to be the offending malware.

    You also haven't advised what the web site is running e.g. static site, WordPress, bespoke, as well as any relevant versions e.g. if WordPress, what version are you running?

    This is an important question, because there may then be additional steps you'll need to take to ensure a repeat of the incident doesn't happen, such as upgrading WordPress, fixing directory permissions on the server etc.

    Tim.
    Signature
    THE Web Development Guru - Bespoke WordPress Theme, Plugin + iPhone Apps [HTML5, CSS3, PHP, MySQL].
    {{ DiscussionBoard.errors[6124089].message }}
  • Profile picture of the author brandonthomas
    Banned
    Hello,

    Maybe your site was hacked and the htaccess file was compromised.
    {{ DiscussionBoard.errors[6290335].message }}
  • Profile picture of the author CrossHash
    i think the first thing to do would be to post your website address ( visitors to have their firewalls and antivirus up to date first ) .. and then we can get a better idea of whats on your site.. CMS .. shopping cart ... who your site is hosted with .. are they secure .. check your info() .php for autoappend .. autoprepend ...
    Signature

    Paul Morris

    {{ DiscussionBoard.errors[6291432].message }}
  • Profile picture of the author so11
    Hello,

    1. Do not download anything on your computer.
    2. Audit/scan your site for vulnerabilities using a web application security scanner
    3. correct/patch identified problems.

    So11
    Signature
    www.groupesoloviev.com
    We help businesses manage cyber risk and compliance requirements.
    {{ DiscussionBoard.errors[6344593].message }}
  • Profile picture of the author zdorian
    You should check with google, they will know the best
    {{ DiscussionBoard.errors[6344770].message }}
  • Profile picture of the author automaton
    Your .htaccess file looks ok. The usual suspects for such cases are often the WP plugins. There are free WP scanners available which you might want to use to check your WP blog for potential vulnerabilities.
    {{ DiscussionBoard.errors[6345282].message }}
  • Profile picture of the author teguhyuliantos
    To make sure your question, better to scann your system use antivirus. After that, you can check it these code, its appear or not?
    Signature
    Specialized Web Hosting for ASP.NET | Latest Hosting Technology Supported
    {{ DiscussionBoard.errors[6348557].message }}
  • Profile picture of the author MightyWarrior
    google can't see your .htaccess file
    {{ DiscussionBoard.errors[6373587].message }}
  • Profile picture of the author BenQ
    Check your plugins. If you have nny that you picked up off BH sites, I'd start the search there and review their main php files. Search for "greek" it's a very common head injection.
    Signature
    {{ DiscussionBoard.errors[6376304].message }}

Trending Topics