How to clean up a base64_decode infected php website.

Geek hat on for this one. A friend had a problem with his website. He had noticed that it was not working properly. Scripts not running as they should and so on. I took a look.

On looking at his PHP scripts, the first line had been replaced with code like:

<?php /**/eval(base64_decode
('aWYoZnVuY3Rpb25fZXhpc3RzKCdX...

Looking further, every PHP script had been changed the same way. It seems one of the scripts he was using had a vulnerability in it. We had to clean up his scripts.

His site had hundreds of PHP scripts that needed cleaning. I had a look and found an easier way to do it, thanks to a bash script by Luis Esteban.

If you find yourself in the same situation, here is how to clean up your site.

MAKE SURE YOU BACK UP YOUR SITE BEFORE CONTINUING.

1. You need secure shell (SSH) access to your webspace. If you don’t have this, ask your webhost. If they won’t let you, sorry - this won’t work.
2. Shell into your webspace and get the name of one of the infected php files
3. Get the offending line of code so we can search all files for it. Enter (replacing infectedfile.php with the correct name):

   head -1 infectedfile.php > yuck

4. Get a list of infected files and save it as “infectedfiles”:

5. find ./ -name '*.php' | while read FILE; do if grep 'eval(base64_decode' "$FILE"; then echo "$FILE" >> infectedfiles; else echo "$FILE" >> notinfected; fi ; done

   Create a shell script with the following code, CHMOD to 744 and run it:

6. #!/bin/bash
   #
   #       remove-infection
   # Script to remove the XYZ infection
   #       from PHP files
   #       Luis Esteban    8 December 2008
   #
   #
   #    grep -Iir base64_decode *
   #
   cat infectedfiles | while read FILE
     do
           echo "Cleaning $FILE"
           FILEHEAD=`head -1 "$FILE"`
           YUCKHEAD=`head -1 yuck`
           if [ "$FILEHEAD" = "$YUCKHEAD" ]
             then
                   echo "Infected, cleaning ..."
                   tail -n+2 "$FILE" > "clean"
                                   mv "clean" "$FILE"
                   echo "$FILE" >> cleaned
             else
                   echo "Not Infected"
                   echo "$FILE" >> notcleaned
           fi
    done
   

   Your site should now be clean.

7. MAKE SURE YOU CHECK ALL SCRIPTS NOW TO STOP IT HAPPENING AGAIN!

UPDATE:I’m sorry if you tried this script and it had errors. WordPress was doing some silly stuff with quotation marks. I’ve fixed it now.

Related posts:

• Is the new BBC news website by CNN’s designers?
• YouTube exploit targets comments