In this blog post, we’ll walk you through the WP-VCD malware attack and how to clean up after it. The malware known by the name “wp-VCD” infects WordPress core through the known “themes” available on the platform. WP-VCD malware hides in legitimate WordPress files and is used to add an admin user. This attack gets access to website server resources. As a result, other websites on the same server are infected. Also, this attack slows down the WordPress website and other websites on the same server. Until you can’t identify and delete the malware root, you will see it appear multiple times.

What is WP-VCD malware?

WP-VCD malware comes with pirated versions of paid themes or plugins where this malware has pre-installed. This attack creates a backdoor as an admin user who allows hackers to access the entire website. The attacker adds a new admin user like “username: 100010010”. And they also infused malicious code to rewrite into WordPress core files like function.php and class.wp.php et cetera. WP-VCD malware attack is difficult to detect as a web owner because the output of this infection is often not visible.

Causes of WP-VCD hack

Pirated version of WordPress themes and plugins is the primary source of this malware. The provider of those free null or pirated plugin themes spreads VCD malware by pre-installing plugins and themes. One good example of those free null providers with malware is “downloadfreeethemes.” Once you install a plugin or theme downloaded from an untrusted source, your website may get infected immediately, and the other websites on the same control panel just within a few minutes. However, you may not be able to know that immediately. Another way to spreading malware wp-vcd malware is outdated software with unrestricted file upload vulnerability.

Identify a WP-VCD malware

  1. First of all, check the admin user of your WordPress website. See, if there are any unknown administrator account, for example, username: “[email protected],” “[email protected]” etc.
  2. Compare core files between WordPress website and original WordPress version. There might have been malicious files like wp-vcd.php and wp-tmp.tmp.
  3. Check your website if some pages are redirecting users to a suspicious website.
  4. Sometimes websites are infected with SEO spam. Which shows up in the Google search results in Japanese keywords or Pharma attack.
  5. Check if suddenly the website started to use high system resources.
  6. Check for malicious JavaScript code in your website source code
  7. Use WAF (Web Application Firewall) plugin to check any changes in your website’s core file, specifically wp-includes and wp-admin folder.
  8. Scan your website using a Security & malware scanner to detect your website is hacked or not.

WP-VCD malware injected files sample

In most cases, we get these below files infected with this VCD script.

  • wp-content/themes/themename/functions.php
  • WP-VCD.php
  • wp-includes/post.php
  • wp-includes/wp-vcd.php
  • wp wp-includes/wp-cd.php
  • includes/class.wp.php
  • wp-includes/wp-feed.php
  • wp-includes/wp-tmp.php

Also, the source of this infection, the pirated or null plugin or theme version, contain a file as class.plugin-modules.php

functions.php

Sample wp-includes/post.php

Sample ../wp-includes/wp-vcd.php

Clean a WP-VCD malware

As the WordPress core is infected, WordPress manual reinstallation is required. Before that, make sure that the source plugin or the theme is detected and removed. Otherwise, this infection will be back at any moment. Here are the steps that should be taken to get rid of WordPress VCD malware.

  1. Identify the source plugin or theme and the source website if multiple websites are infected in the same server.
  2. Remove the null plugin or theme that contain a file class.plugin-modules.php
  3. Except wp-content, wp-config.php, .htacess, remove everything else from the domain root directory
  4. Check every theme functions.php file, check and remove the first block of PHP if you see malicious VCD script
  5. Download a fresh and latest version of WordPress
  6. Extract the downloaded zip, remove the "wp-content" directory, zip it again. upload and extract under the domain directory

Those are basic steps mentioned above but the site may still contain malicious files under themes or plugins. Please take professional help to make sure the website is clean and secure.