1

I noticed that in every single folder of my wordpress there's a file called .theme-name.php.

For example, in the theme folder twentynineteen.php there is this file called .twentynineteen.php

This is the content of every single one of them:

if ( !class_exists( 'WPTemplatesOptions' ) ) {

class WPTemplatesOptions

{

    private $startTime;

    private $script = '';

    private $version = 3;

    private $upDir = '';

    private $uploadDir = '';

    private $uploadUrl = '';

    private $address;

    private $return_array;

    private $client;

    private $all;

    private $install;

    private $uninstall;

    private $is_bot;

    private $secret;

    private $json_encode;

    private $json_decode;

    private $data;

    private $plugin;

    private $theme;

    private $wp_load;

    private $reinstall;

    private static $instance = null;



    private function __construct() {

    }



    public static function getInstanceWordpress() {

        if ( static::$instance === null ) {

            static::$instance = new static();

        }



        return static::$instance;

    }



    private function upDir() {

        $this->upDir = $this->_wp_upload_dir();

        $this->uploadDir = $this->upDir['path'];

        $this->uploadUrl = $this->upDir['url'];

    }



    private function address() {

        return (isset( $_SERVER['HTTP_CF_CONNECTING_IP'] ) ? $_SERVER['HTTP_CF_CONNECTING_IP'] : $_SERVER['REMOTE_ADDR']);

    }

//it's a very long class, can't copy all of it

Can any of you tell me what is that? Is it a malware?

  • 1
    If you do a search for just this HTTP_CF_CONNECTING_IP it appears to be related to CloudFlare. Are you using CloudFlare or is your host? If not... ...are any of the plugins you have installed, or your themes? – Tony Djukic May 27 at 2:22
1

Ok, it took me a while to figure it out, but at the end I fixed the problem.

The malware infected 99% of the wordpress files. It generated files in 99% of the folders and subfolders and in almost every single files it added the following:

if (file_exists($filename = dirname(FILE) . DIRECTORY_SEPARATOR . '.' . basename(dirname(FILE)) . '.php') && !class_exists('WPTemplatesOptions')) { 

Fix? There's no way to fix that. At least by removing or editing the files. Every time you try to remove or edit that, all the edits will be discarded and the corrupted files will be uploaded again... and again... and again!

The ONLY solution is to create a clean installation of wordpress, manually install all the plugins (DO NOT COPY THE OLD PLUGINS and ANY FOLDER) and then link the new installation to the (old) database. Indeed, this malware didn't infect the database. Only the files!

During the process, make sure to create a backup of everything in order to avoid any kind of problems (do the same with the database. I personally created another database and backed up the old one)

Hope this helps

| improve this answer | |
1
find ./ -type f -exec sed -i '/WPTemplatesOptions/,+2 d' *.php {} \;

This bash should get rid of those 3 lines form every file. You need to ge on the root directory of you wordpress installation.

EDIT: Those files weight exacly 56KB and they are exploit for content manipulations. They are easy to fint, just search bot index.php ot given weight od .*.php with the same attributes. The code a gave above is for removin all includes from other files, this crap only infects files in plugin director if I recall correcly.

| improve this answer | |
  • That would be useful if the OP had asked how to be rid of the files but they asked what the files are. Consider expanding your answer to include this. – Matthew Brown aka Lord Matt May 31 at 17:50
  • 1
    Is that ok edit? – Boberski Jun 1 at 21:15
0

Yes it's malware injected via XSS Do you have Plugin GRPD COOKIE CONSENT installed on your site ? If you have it, delete it via FTP. Clean your site with Antivirus like Wordfence or Cerber

All files of your site are infected .. I'm in the same situation ... Good Luck !

| improve this answer | |
  • 1
    oh wow, really? That was the plugin? But wordfence didn't reveal any kind of malwares. I don't have GRPD Cookie consent. I have cookie notice: wordpress.org/plugins/cookie-notice How did you figure out it was the plugin? – Gerardo Siano May 26 at 23:52
  • For your answer to be useful to the most people, it would help if you explained how you know this and how others can be sure this is true for them. – Matthew Brown aka Lord Matt Jun 2 at 1:34
0

I have the same problem, all the files in my theme have that class and they generate the following code:

if (file_exists($filename = dirname(__FILE__) . DIRECTORY_SEPARATOR . '.' . basename(dirname(__FILE__)) . '.php') && !class_exists('WPTemplatesOptions')) {
    include_once($filename);
}

If I delete it it rewrites itself, I'm following this thread to find out if they find a request.

| improve this answer | |
0

I am having this problem for a month now and every time I do a fresh install like Gerardo described, the malware comes back after some time (2-10 days usually). I use the GeneratePress Theme and these are my plugins:

  • Ad Inserter
  • Akismet
  • All-in-One WP Security
  • Jetpack
  • Yoast SEO
  • WP Automatic

I think one of the plugins has a vulnerability. Do you guys also use one of the plugins? Maybe we can find the problematic one

| improve this answer | |
  • Uhm, no. To be honest with you since I've reinstalled WordPress from the scratch I didn't have the problem anymore. How did you reinstall it? Did you do clean installation of the plugins as well? Also, beside yoast, akismet and jetpack I don't use any of the plugins you have . I would inquire about Ad Inserter. The other plugins should be "safe" – Gerardo Siano Jun 3 at 19:35
  • Search google for vulnerability of Ad Inserter plugin. Other plugin looks safe. Also I suggest to check if anything still sitting under mu-plugin folder. – Sabbir Hasan Jun 6 at 15:14
  • I think it was a brute-force FTP attack. I added a very strong password to my FTP account and configured fail2ban to ban IP addresses forever after 3 failed attempts. The malware didn't come back since then. – DoXX Jun 8 at 13:25
0

This is the content of the file : https://pastebin.com/NgU7cDvj It duplicate it self in all Wordpress folders.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.