KrisChase.com

How to find and clean up infected WordPress Files over SSH

Posted in Web Development on 06.10.2015 by @chasebadkids

If you’ve ever found yourself with a hacked WordPress site, one of the hardest things to do is scan your entire server and find all of the infected files.  I’ve had to do this a few times for various clients and friends so I decided to put together a little writeup on how to make it a bit easier.

First open up an SSH connection to your server

Change directory to the location of your site(s). Depending on your hosting provider this could be in a number of locations, it’s best to consult with them to determine where you should change directory to

Execute the following

What this does is search from the current directory, down into any deeper directory through all PHP scripts and looks for “eval(base64_decode” which is one of the most common ways hackers hide malicious code. You can also switch this out for a few different strings like:

  • eval
  • base64_decode
  • gzinflate
  • eval(gzinflate(base64_decode

Any combination of those strings will usually result in all of the infected files.

Once the script finds malicious files they are then put into your file “infectedfiles.txt” in the same directory you executed the script from.

In order to see which files were infected you can run

Once you’ve found all your infected files, I can help you automate the cleanup process, however, before doing that it’s always a great idea to BACKUP YOUR DATA

Once you’ve created a backup, go ahead and use the following (with caution)

When using this script you can change the “PATT” variable value to whatever malicious string you used to find your infected files.

If you don’t care about having a list of all your infected files and want to jump straight to the cleanup process you can use this other script I usually use:

Save that script to a file (I usually go with fix.sh) and then execute the file using the following syntax:

Keep in mind you can change the “eval(gzinflate(base64_decode” piece to whatever malicious string you’re looking for.

I hope that these scripts help others as much as they’ve helped me when it comes to cleaning up infected WordPress servers.

Menu