{"id":20496,"date":"2023-05-01T12:24:12","date_gmt":"2023-05-01T11:24:12","guid":{"rendered":"https:\/\/wpbeveiligen.nl\/?p=20496"},"modified":"2023-05-01T12:24:12","modified_gmt":"2023-05-01T11:24:12","slug":"this-is-how-to-recognize-a-virus-file","status":"publish","type":"post","link":"https:\/\/wpbeveiligen.nl\/en\/this-is-how-to-recognize-a-virus-file\/","title":{"rendered":"This is how to recognize a virus file!"},"content":{"rendered":"<p>For me as a WordPress specialist, it&#8217;s easy to see which files don&#8217;t belong on the server. But there are also several ways you can recognize a virus file or a spam file!<\/p>\n<h2>This is how you recognize a virus file<\/h2>\n<ul>\n<li><strong>The file has a different modification date on the server.<\/strong><br \/>\nAll files have the modification date from when you installed WordPress, but the virus file has a more recent date.<\/li>\n<li><strong>The file has a code that is unreadable, all numbers and letters mixed together.<\/strong><br \/>\nThe file is often encrypted, All you can read then is eval65. This is the encoding after which the numbers and letters come. The server executes this strange code like regular php but it is not readable to humans like regular php is.<\/li>\n<li><strong>The file has a strange name.<\/strong><br \/>\nSince files should not be recognizable by virus scanners from the server, the name is generated so you get random letters and numbers as the file name.<\/li>\n<li><strong>Often the file is located in the httpdocs\/root of the website.<\/strong><br \/>\nSince directories change quite often, the hacking scripts often target the root directory of your website. But there is also a fairly good chance that there are multiple files. Consider the wp-includes folder and the uploads folder.<\/li>\n<li><strong>The file is 9-of-the-10x a .php file.<\/strong><br \/>\nPhp files can execute scripts, which is why they are usually php files and very occasionally html.<\/li>\n<\/ul>\n<p>These are some ways to recognize files put on your server by a script. However, if your WordPress is leaky, they can also inject lines of code into your existing files. These are therefore more difficult to detect.<\/p>\n<p>They often put the lines of code in the index.php, the header.php or in the WordPress core files.<\/p>\n<p>Beware! Once you have removed the files, the problem is not solved. After that, it is important that you secure WordPress and make sure there is no more code in your website. This is because if there is a so-called backdoor in your website, they can still place files on your server through that route. And yes, this unfortunately happens often.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>For me as a WordPress specialist, it&#8217;s easy to see which files don&#8217;t belong on the server. But there are also several ways you can recognize a virus file or a spam file! This is how you recognize a virus file The file has a different modification date on the server. All files have the [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":98,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[186,194],"tags":[],"_links":{"self":[{"href":"https:\/\/wpbeveiligen.nl\/wp-json\/wp\/v2\/posts\/20496"}],"collection":[{"href":"https:\/\/wpbeveiligen.nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wpbeveiligen.nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wpbeveiligen.nl\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/wpbeveiligen.nl\/wp-json\/wp\/v2\/comments?post=20496"}],"version-history":[{"count":0,"href":"https:\/\/wpbeveiligen.nl\/wp-json\/wp\/v2\/posts\/20496\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wpbeveiligen.nl\/wp-json\/wp\/v2\/media\/98"}],"wp:attachment":[{"href":"https:\/\/wpbeveiligen.nl\/wp-json\/wp\/v2\/media?parent=20496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wpbeveiligen.nl\/wp-json\/wp\/v2\/categories?post=20496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wpbeveiligen.nl\/wp-json\/wp\/v2\/tags?post=20496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}