This page explains the cause and how to target a string starting with @include that suddenly appears at the top of wp-config.php or index.php in WordPress.

@include at the top of wordpress wp-config.php or index.php What is this?

Simply put, this is often a loading program for malware to run on all pages where the site has been defaced by hackers and this description allows users to view the site.

The loading code for this malware, which is generally very common, is as follows

/*88783*/
@include "7var/\167ww/the5e/.81941729.ic7";
/*88783*/

The first line and the random string of characters/numbers sandwiched between the /* in the last line are keys to confirm the existence of the malware to embed the same tampering again when this tampering is removed.

In the second line, following @include, a program is written to read and execute the malware itself, but it is obfuscated so that its contents cannot be seen as is.

You can un-obfuscate it here.
Once the obfuscation is removed, you will see that the full path to the malware is described as shown below.

/*88783*/
@(include "/var/www//theme/.89941729.ico");
/*88783*/

How to deal with this malware

1 Unobfuscate the relevant string and find the path to the malware itself.

2 Delete the malware itself from the server using ftp software, etc. (We recommend that you do a full backup of your site). (We recommend that you do a full backup of your site before proceeding)

3 Remove the tampered parts at the top of wp-config.php and index.php and re-upload them to the server.

Also, the presence of this tampering is most likely another tampering on the site, a backdoor (a gateway for hackers), or a vulnerability in a plugin or password.

Be sure to check your plugins for malware and vulnerabilities.

4 Remove vulnerabilities and other malware and backdoors as described above.

5 We also recommend that you change the password for the administrator user

Our malware plugin is capable of detecting nearly 7,000 types of malware, but some will inevitably be missed. For a complete cleanup, we recommend that you have a professional decontaminate your system.

Related Posts:

  1. If your wordpress index.php has a one line include statement @include it is infected with malware
    If there is a one-line include statement @include in the index.php in the top directory of WordPress or in the theme, etc., it is highly likely that the site is infected with malware....
  2. HTACCESS and Index.php files tampered with again in an instant in WordPress
    We would like to introduce a case of WordPress tampering in which the HTACCESS and Index.php files were instantly tampered with again, even after the malware was removed. Tampering that resurfaces even after deleting and deleting This malware is a backdoor that is planted in other websites on the server. Each time the site is accessed, the malware examines the...
  3. Reasons for repeated hacker defacement and malware infection on WordPress sites
    Once a WordPress site has been defaced by hackers, embedded malware, or infected with a virus, the site may be repeatedly defaced even after you think you have removed the malware. We will explain how to deal with such cases....
  4. How to remove WordPress malware (tampering and viruses) with plugins
    We will explain how to decontaminate malware using the WordPress:Malware Scan & Security plugin [Malware and Virus Detection and Removal], which was created by WordPress Doctor based on his experience with numerous malware removal requests....
  5. What many people misunderstand about WordPress security.
    We have summarized some of the security measures taken by WordPress, which are often misunderstood by many people and often result in tampering and malware embedding!...
  6. What is a WordPress injection attack?
    There are various methods by which WordPress can be hacked, the most common of which is called an injection attack. This section describes these injection attacks....