Take the 2-minute tour ×
WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. It's 100% free, no registration required.

Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html

On investigating the access logs following entries were found which seem to be malicious and similar to time in which this files were created.

91.207.9.226 - - [23/Apr/2013:17:41:19 +0530] "GET / HTTP/1.1" 200 19928 "http://remont-mobile-phones.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru) Opera 8.01"
91.207.9.226 - - [23/Apr/2013:17:41:21 +0530] "GET / HTTP/1.1" 200 19928 "http://remont-mobile-phones.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru) Opera 8.01"

Can anyone help in understanding the nature of attack and suggestive actions to be taken now.

share|improve this question
    
Start with WordPress's own "So You've Been Hacked" article: codex.wordpress.org/FAQ_My_site_was_hacked –  Pat J Apr 23 '13 at 12:52
    
I have already taken all such steps. Just trying to understand the log entry –  Mayur Karwa Apr 23 '13 at 13:06
    
Check your .htaccess –  Obama Apr 23 '13 at 13:12
    
htaccess is clean. nothing other than normal code found –  Mayur Karwa Apr 23 '13 at 15:16
    
thanks s_ha_dum. I was unaware about such standards. Got all the details from advanced help section now. –  Mayur Karwa Apr 24 '13 at 4:10

1 Answer 1

It looks like your server is using Apache's Combined Log Format. So here's what's actually in your logfile lines:

91.207.9.226 {Remote client's IP address}
- {Remote user ID, generally unused}
- {Authenticated user ID, unused in most cases}
[23/Apr/2013:17:41:19 +0530] {Date}
"GET / HTTP/1.1" {Request - here they asked for your site's home page, essentially}
200 {Status code -- 200 = Success}
19928 {Transferred data -- your homepage is 19928 bytes}
"http://remont-mobile-phones.ru/" {Referer}
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru) Opera 8.01" {User-agent / browser}

It appears that someone (or some 'bot, or other software) at IP 91.207.9.226 clicked on a link to http://[your site]/ on the site at http://remont-mobile-phones.ru/.

These two entries look pretty innocent to my eyes -- though I will admit I'm not an expert. Is there anything around the same time in your access or error logs?

share|improve this answer
    
Thanks for explaining the log format. this entries were found in access logs, no other entries found. Also, couldn't find anything relevant in the error log : Just the following entry : "PHP Warning: Cannot load module 'XCache' because conflicting module 'eAccelerator' is already loaded in Unknown on line 0" –  Mayur Karwa Apr 24 '13 at 3:43
    
Is it possible the files were placed there by some other method? FTP, SFTP, etc.? –  Pat J Apr 24 '13 at 4:13

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.