One similar hack, in the same vein as the Tim Thumb Hack is the Cannot Redeclare Hack. This is an error that prompts Google to mark your website as unsafe, and you get the following error:
Site error detected. Details: http://sucuri.net/malware/php-error-fatal-error Fatal error: Cannot redeclare _765258526() (previously declared in /path/domain-name.tld/wp-content/themes/Theme-name/footer.php(18) : eval()’d code:1) in /path/domain-name.tld/index.php(18) : eval()’d code on line 1
The malware code is inserted into the client’s footer, but the main infection is an Index.php page one.
However, luckily there is a fix for this issue.
But first, here’s how to check if you are infected in the first place:
The first step is to open any page of your site and see if the error message above is displayed. The message is very specific and very rarely it’s a bug of the WordPress website.
The second step is to search for the index.php and footer.php files on the server. Usually, the entire list of WordPress sites on the same server will be affected.
SO, if you’re hosting/hosted on a server with many WordPress websites, the easiest way to find your files is to do a search.
Within the .php files found, look for the ones that include “eval(gzun” and then a lot of unreadable encoded messages.
Cleaning up is relatively easy.
You have to look for the following line:
;
Yes, that’s how it’s going to look – it’s not an error – that’s the entire sequence of malicious code. Just one line!
What do you want to do with this line of ugly code? DELETE it, of course. And, with it gone, the hack is no longer there, you’re clean!
In order to prevent this hack from ever happening, it’s the job of your host – the server provider, to secure it. If you’re hosting your website(s) yourself, you should make your server safer, and the steps to take have been covered in another of our articles.
Code Sources – www.digwp.com.