Is this Malware code?

by 15 replies
17
Google has identified my sites as having Malware. I am trying to find where the code is. Can anyone tell me if all of this in an .htaccess file is malicious code? Thanks!
# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
# END WordPress
<Files 403.shtml>
order allow,deny
allow from all
</Files>
deny from 83.103.119.239
deny from 80.83.210.250
deny from 69.90.162.100
deny from 193.105.240.173
deny from 80.243.174.25
deny from 174.37.182.234
deny from 69.125.222.180
#programming #code #malware
  • No it isn't. Everything there looks fine to me. Usually you'll find javascript redirecting to a site or pulling information from a site which is what Google is picking up on.
  • this is your .htaccess file's contents. check index.php or footer.php in your current wordpress theme. you can also check your website at sucuri dot net.
  • Well, I don't think so that it is a malware virus, do you have any viruses in your PC? Or you upload things from your computer on your site?
    • [1] reply
    • That's definitely not malware. How about providing a link to the site so we can look and see?
  • If you're using a nulled/cracked CSM/Forum/Blog software, chances are theirs a phishing site embedded somewhere.
  • check your scripts. Some injects js on it and redirects it on a malware infected site
  • The approach to take with this is:

    1. Download a copy of your web site files
    2. Search through all of the files using a text editor or similar for any of the following words:
    eval
    base64
    <script

    3. Look at every match that appears, and if any of them have what appear to be 'garbled' or non-readable code e.g. a lot of random letters, numbers and symbols, then it's likely to be the offending malware.

    You also haven't advised what the web site is running e.g. static site, WordPress, bespoke, as well as any relevant versions e.g. if WordPress, what version are you running?

    This is an important question, because there may then be additional steps you'll need to take to ensure a repeat of the incident doesn't happen, such as upgrading WordPress, fixing directory permissions on the server etc.

    Tim.
  • Banned
    Hello,

    Maybe your site was hacked and the htaccess file was compromised.
  • i think the first thing to do would be to post your website address ( visitors to have their firewalls and antivirus up to date first ) .. and then we can get a better idea of whats on your site.. CMS .. shopping cart ... who your site is hosted with .. are they secure .. check your info() .php for autoappend .. autoprepend ...
  • Hello,

    1. Do not download anything on your computer.
    2. Audit/scan your site for vulnerabilities using a web application security scanner
    3. correct/patch identified problems.

    So11
  • You should check with google, they will know the best
  • Your .htaccess file looks ok. The usual suspects for such cases are often the WP plugins. There are free WP scanners available which you might want to use to check your WP blog for potential vulnerabilities.
  • To make sure your question, better to scann your system use antivirus. After that, you can check it these code, its appear or not?
  • google can't see your .htaccess file
  • Check your plugins. If you have nny that you picked up off BH sites, I'd start the search there and review their main php files. Search for "greek" it's a very common head injection.

Next Topics on Trending Feed

  • 17

    Google has identified my sites as having Malware. I am trying to find where the code is. Can anyone tell me if all of this in an .htaccess file is malicious code? Thanks! # BEGIN WordPress <IfModule mod_rewrite.c>