Get Off Those Maliciously Loaded Scripts!
Download this free Anti-Malware Plugin for WordPress.

Yes, with a lot of code changes it would be possible to re-purpose my plugin to be more proficient at scanning larger file-systems containing multiple site under conditions where the shared hosting platform permits the PHP process to access all the sites on the account. However, that would require exploiting the biggest vulnerability of cheap shared hosting accounts to access and change the files of one site from the PHP execution of another site. While this is all too common and easy to do in many cases, it is also the main reason that all your sites can be infected with a malicious PHP scripts that makes it way into one weak site.

Now, wouldn’t it be better all around if each of your sites had more protective permissions so that these malware infection wouldn’t be able to infect every site on your server from just one breach?

My conclusion is that if the hosting providers implemented a reasonable security scheme then my plugin would then not even be able to access those other sites and could then not scan or clean them, and that would actually make your system even safer.

The best way to reach me is directly through email. You can reply directly to any of these email notification from my forum. I also pinged you on Skype if you would rather find me there, I’m not usually on Skype but I’ll hang out there for a little while if you want to accept my invitation.

Thank you for contacting me about this issue. I would very much like to find a solution the the issue you are having with the scan so I will need more information about this “comedy just”…

First, you have registered multiple sites on this account, which of your sites are having this issue?

When you say that it “cleans it and stops its work”, can you include if it gives all the indications that it has worked? Did you see all the following indicators:
1. Did it pop up a box to say “2 files fixed, 0 failed”?
2. Did it say “Success!” at the end of each file listed in the “Fixing …” results window?
3. Did it finish with Big green bar that end with the words” it worked”
4. Did it show a window below the green bar that starts with a green checkbox and the words “Tested your site. It appears we didn’t break anything ”, and then show a list of all the quarantined files?
5. If you got that far or if you can got back to the Anti-Malware Quarantine page in your wp-admin for me, then please let me know: are the items listed in the quarantine highlighted in Yellow or are they in Red?

A screenshot of any of these results would be very helpful, but if you can answer those 5 questions above then I will have a clear understanding of how far the scan and fix process got and can then help you troubleshoot.

Alternatively, if you would prefer to send me your wp-admin login for this site then I would be happy to troubleshoot the issue directly.

Unfortunately this situation is all too common and there are a great many reasons why you might be plagued by recurring infection. The main problem is that they were able to exploit your server in the first place, and they could be using that same vulnerability for each subsequent attack. The second issue is that once they get in they are then able to infect every site on your account (and possibly even other accounts too).

So why is this even possible? In one word: Hostgator, All these giant Shared Hosting provider want to do is cram as many users as they can onto as few servers as possible to make their service as cheap as it can be. They don’t really care about security because they don’t see it as they problem, they have specifically made that your problem.

I am openly critical of these massive shared hosting platforms because I also run my own Super Secure Hosting servers and it’s not hard to take the proper security measures but I can’t compete with their pricing and that’s why they have all the customers.

The hard truth about your situation is that if you have more than just a couple sites it’s going to be really hard to pin down where this threat is coming from you will need to do extensive digging in your log files to find the exploit and that’s assuming that the the vulnerability being exploited is even on one of your own sites. The best thing for you to do now is to try moving some of these sites to other servers and try to figure out which of those sites are spreading this infection and which ones are secure on their own and just getting cross-contaminated by the compromised site(s).

A quick internet search for “lb_postrender_handler” shows that this OB Handler was most likely injected into your sites with malicious code. My plugin just detects any and all uses of named OB Handlers because of the potential for any of them to adversely affect the output on your admin pages, specifically the results of the scan. Therefore, this warning can sometime point to an issue that needs to be dealt with immediately. In this case it sounds like it is an infection that is now spreading to al your other sites, so you definitely want to pin down where it is coming from.

If you have truly deactivated all other plugins then my next guess would be that this malicious code has been added to your theme, although it is also possible that the code was injected into a WordPress core file.

Then next step would be to reinstall a fresh copy of the theme that you are currently using and the then reinstall the WordPress core files.

Just to confirm that this is your only course of action, I want to make sure that you have already run the Complete in my Anti-Malware plugin and that nothing was found, is that correct?

This is, unfortunately, a fairly typical situation you are describing. If you are hosting many sites on a shared hosting account with any of the major mass-hosting providers then one small break on any one site can lead to a massive widespread infection on all your sites. The main issue is that there is absolutely not internal security protecting all your sites from crossover contamination. Once you have a self-replicating threat on your account it simply copies itself to to every directory that it has access to (which is essentially all the folders on all your sites). At which point, the all the infected sites collaborate in rapidly re-spreading this threat into any place where you might be temporarily successful at removing it.

Therefore, the only way to remove this type of threat is a well-timed all-encompassing mas-removal of every infection on every site at the same time, thus removing any chance it might have to reduplicate. My plugin can be useful in removing these threats from a whole site very quickly but you sill have to make sure that each site is cleaned at the same time so that they cannot reinfect each other. If even one of these active scripts is missed then you will soon find yourself right back where you started.

Ideally, you would have a hosting environment that could “chroot” (isolate and make a virtually separate filesystem for) each site so that they cannot infect each other. This would make it easy to clean each site and keep them from getting reinfected. Then you could quickly ascertain which or your sites was responsible for this breach and work towards patching the original exploit. But this screamingly obvious solution goes against the ease of access that you and your hosting provider have grown accustomed to, and it would cripple you current control panel access. Think of like this, your control panel is nothing more than a set of PHP scripts that give you full control over all the sites on your account; any malicious planted on your site has the exact same access and therefore the same control over all your site.

I know this is not the simple solution you were probably hoping for, but I wanted to paint a picture of the true nature of the unfortunate position you find yourself in so that you can start to understand the complexity of the many tactics that you might employ to combat this problem. With the understanding that this infection is exacerbated by the lax security of your hosting provider and multiplied by the sheer number of sites that you have on this account, I see two main approaches for you to take:

a. Move all, or most, or at least some of your sites to another (hopefully more secure) hosting provider in order to compartmentalize your infection so that it is easier to treat in smaller doses.

b. Devote a lot of energy and effort into a full-scale coordinated attack against every threat on your system at once, being aggressively vigilant and relentless on every front until you have squashed your opponent completely.

With each of these approaches there are many different branches which can more or less effective depending on the nuances of your specific variant. The import thing to remember in your specific circumstance is that there are at least three objectives:

1. The most obvious damage to your sites are these .htaccess files, which are crippling each site and clearly need to be removed in order to restore normal functionality.

2. More important are the PHP scripts that are injected into various hiding places with your sites normal code, which are responsible for creating all those .htaccess files and also replicating themselves into other parts of your site and probably your other sites as well. All these must be removed together to ensure that none are left to make more clones all over again.

3. Most importantly, you need to find the security vulnerability or exploit that allowed the original threat to be planted on your account in the first place. Unfortunately, this is also the hardest part of the process and also might only be able to be found by a skilled professional and/or maybe only after repeated breaches and further re-infections which might reveal a pattern or leave a trail back to the open door.

I realize this might have created more questions that it has answered for you so please feel free to write back if you need more clarity or help with any specific problems you encounter.

My plugin doesn’t delete files, it just removes the malicious code from the infected files and every change is automatically backed up in the Anti-Malware Quarantine. There is a link on the results page that will revert your changes in case something goes wrong and you can also review and revert any changes made from the Quarantine page in your wp-admin. Please contact me directly if you need more help but if you have deleted any files yourself (manually, not through my plugin) and you don’t have a backup then there is nothing I can do to help you with that, you may need to re-install WordPress if that is the case.