1

I noticed that in every single folder of my wordpress there's a file called .theme-name.php.

For example, in the theme folder twentynineteen.php there is this file called .twentynineteen.php

This is the content of every single one of them:

if ( !class_exists( 'WPTemplatesOptions' ) ) {

class WPTemplatesOptions

{

    private $startTime;

    private $script = '';

    private $version = 3;

    private $upDir = '';

    private $uploadDir = '';

    private $uploadUrl = '';

    private $address;

    private $return_array;

    private $client;

    private $all;

    private $install;

    private $uninstall;

    private $is_bot;

    private $secret;

    private $json_encode;

    private $json_decode;

    private $data;

    private $plugin;

    private $theme;

    private $wp_load;

    private $reinstall;

    private static $instance = null;



    private function __construct() {

    }



    public static function getInstanceWordpress() {

        if ( static::$instance === null ) {

            static::$instance = new static();

        }



        return static::$instance;

    }



    private function upDir() {

        $this->upDir = $this->_wp_upload_dir();

        $this->uploadDir = $this->upDir['path'];

        $this->uploadUrl = $this->upDir['url'];

    }



    private function address() {

        return (isset( $_SERVER['HTTP_CF_CONNECTING_IP'] ) ? $_SERVER['HTTP_CF_CONNECTING_IP'] : $_SERVER['REMOTE_ADDR']);

    }

//it's a very long class, can't copy all of it

Can any of you tell me what is that? Is it a malware?

2

6 Answers 6

1

Ok, it took me a while to figure it out, but at the end I fixed the problem.

The malware infected 99% of the wordpress files. It generated files in 99% of the folders and subfolders and in almost every single files it added the following:

if (file_exists($filename = dirname(FILE) . DIRECTORY_SEPARATOR . '.' . basename(dirname(FILE)) . '.php') && !class_exists('WPTemplatesOptions')) { 

Fix? There's no way to fix that. At least by removing or editing the files. Every time you try to remove or edit that, all the edits will be discarded and the corrupted files will be uploaded again... and again... and again!

The ONLY solution is to create a clean installation of wordpress, manually install all the plugins (DO NOT COPY THE OLD PLUGINS and ANY FOLDER) and then link the new installation to the (old) database. Indeed, this malware didn't infect the database. Only the files!

During the process, make sure to create a backup of everything in order to avoid any kind of problems (do the same with the database. I personally created another database and backed up the old one)

Hope this helps

1
find ./ -type f -exec sed -i '/WPTemplatesOptions/,+2 d' *.php {} \;

This bash should get rid of those 3 lines form every file. You need to ge on the root directory of you wordpress installation.

EDIT: Those files weight exacly 56KB and they are exploit for content manipulations. They are easy to fint, just search bot index.php ot given weight od .*.php with the same attributes. The code a gave above is for removin all includes from other files, this crap only infects files in plugin director if I recall correcly.

2
  • That would be useful if the OP had asked how to be rid of the files but they asked what the files are. Consider expanding your answer to include this. May 31, 2020 at 17:50
  • 1
    Is that ok edit?
    – Boberski
    Jun 1, 2020 at 21:15
0

Yes it's malware injected via XSS Do you have Plugin GRPD COOKIE CONSENT installed on your site ? If you have it, delete it via FTP. Clean your site with Antivirus like Wordfence or Cerber

All files of your site are infected .. I'm in the same situation ... Good Luck !

2
  • 1
    oh wow, really? That was the plugin? But wordfence didn't reveal any kind of malwares. I don't have GRPD Cookie consent. I have cookie notice: wordpress.org/plugins/cookie-notice How did you figure out it was the plugin? May 26, 2020 at 23:52
  • For your answer to be useful to the most people, it would help if you explained how you know this and how others can be sure this is true for them. Jun 2, 2020 at 1:34
0

I have the same problem, all the files in my theme have that class and they generate the following code:

if (file_exists($filename = dirname(__FILE__) . DIRECTORY_SEPARATOR . '.' . basename(dirname(__FILE__)) . '.php') && !class_exists('WPTemplatesOptions')) {
    include_once($filename);
}

If I delete it it rewrites itself, I'm following this thread to find out if they find a request.

0

I am having this problem for a month now and every time I do a fresh install like Gerardo described, the malware comes back after some time (2-10 days usually). I use the GeneratePress Theme and these are my plugins:

  • Ad Inserter
  • Akismet
  • All-in-One WP Security
  • Jetpack
  • Yoast SEO
  • WP Automatic

I think one of the plugins has a vulnerability. Do you guys also use one of the plugins? Maybe we can find the problematic one

3
  • Uhm, no. To be honest with you since I've reinstalled WordPress from the scratch I didn't have the problem anymore. How did you reinstall it? Did you do clean installation of the plugins as well? Also, beside yoast, akismet and jetpack I don't use any of the plugins you have . I would inquire about Ad Inserter. The other plugins should be "safe" Jun 3, 2020 at 19:35
  • Search google for vulnerability of Ad Inserter plugin. Other plugin looks safe. Also I suggest to check if anything still sitting under mu-plugin folder. Jun 6, 2020 at 15:14
  • I think it was a brute-force FTP attack. I added a very strong password to my FTP account and configured fail2ban to ban IP addresses forever after 3 failed attempts. The malware didn't come back since then.
    – DoXX
    Jun 8, 2020 at 13:25
0

This is the content of the file : https://pastebin.com/NgU7cDvj It duplicate it self in all Wordpress folders.

Not the answer you're looking for? Browse other questions tagged or ask your own question.