0

Today we saw suddenly two files created in root folder in one of our wordpress websites - file name owp.php and gmail.html

On investigating the access logs following entries were found which seem to be malicious and similar to time in which this files were created.

91.207.9.226 - - [23/Apr/2013:17:41:19 +0530] "GET / HTTP/1.1" 200 19928 "http://remont-mobile-phones.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru) Opera 8.01"
91.207.9.226 - - [23/Apr/2013:17:41:21 +0530] "GET / HTTP/1.1" 200 19928 "http://remont-mobile-phones.ru/" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru) Opera 8.01"

Can anyone help in understanding the nature of attack and suggestive actions to be taken now.

5
  • Start with WordPress's own "So You've Been Hacked" article: codex.wordpress.org/FAQ_My_site_was_hacked
    – Pat J
    Apr 23, 2013 at 12:52
  • I have already taken all such steps. Just trying to understand the log entry Apr 23, 2013 at 13:06
  • Check your .htaccess
    – Obama
    Apr 23, 2013 at 13:12
  • htaccess is clean. nothing other than normal code found Apr 23, 2013 at 15:16
  • thanks s_ha_dum. I was unaware about such standards. Got all the details from advanced help section now. Apr 24, 2013 at 4:10

1 Answer 1

0

It looks like your server is using Apache's Combined Log Format. So here's what's actually in your logfile lines:

91.207.9.226 {Remote client's IP address}
- {Remote user ID, generally unused}
- {Authenticated user ID, unused in most cases}
[23/Apr/2013:17:41:19 +0530] {Date}
"GET / HTTP/1.1" {Request - here they asked for your site's home page, essentially}
200 {Status code -- 200 = Success}
19928 {Transferred data -- your homepage is 19928 bytes}
"http://remont-mobile-phones.ru/" {Referer}
"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; ru) Opera 8.01" {User-agent / browser}

It appears that someone (or some 'bot, or other software) at IP 91.207.9.226 clicked on a link to http://[your site]/ on the site at http://remont-mobile-phones.ru/.

These two entries look pretty innocent to my eyes -- though I will admit I'm not an expert. Is there anything around the same time in your access or error logs?

2
  • Thanks for explaining the log format. this entries were found in access logs, no other entries found. Also, couldn't find anything relevant in the error log : Just the following entry : "PHP Warning: Cannot load module 'XCache' because conflicting module 'eAccelerator' is already loaded in Unknown on line 0" Apr 24, 2013 at 3:43
  • Is it possible the files were placed there by some other method? FTP, SFTP, etc.?
    – Pat J
    Apr 24, 2013 at 4:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.