1

Hi, a friend just had their site red flagged (blacklisted) I said I’d help. Archived the contents of public_html installed WP, secured the site and asked Google for review. All good. Then the host restored the old site HTML site (not by my request) but it’s all working. However security scan says no redirect to SSL. Site is loading https version. I look at the .htaccess file and I don’t understand it. I’m going to attach the file. Can anyone tell me what it’s doing and is it legit? Thanks very much. Here’s a sample of the file - it goes on like this for 400+ lines:

RewriteEngine on
RewriteRule ^check_work/$ ./chave/lexyus.php?checkwork
RewriteRule ^teressa-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^tor-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^swept-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^hms-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^pantern-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^windsock-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^pessoa-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^geese-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^circulator-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^parisienne-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^apmlifier-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^speckling-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^busted-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^storefront-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^aspheric-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^serloin-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^megavideo-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^diamondk-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^faeces-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^loops-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^tercks-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^wordingf-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^advertizing-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^sabul-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^capprice-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^seminoles-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^stines-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^aser-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^cmt-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^appart-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^fermale-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^sequence-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^bathrobe-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^squi-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^carmichael-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^geer-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^mined-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^atsisiusti-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^luke-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^wwe-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^cabenet-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^wilco-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^winows-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^rewriter-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^octapuss-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^slits-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^flats-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^lancs-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^rado-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^undocumented-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^braken-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^trapmaster-(.)/$ ./chave/lexyus.php?$1
RewriteRule ^alaskan-(.*)/$ ./chave/lexyus.php?$1

52872929-4472-460f-bb1f-2078b3298411-htaccess_met.txt (49.1 KB)

4 Spice ups
2

Looking at that I’d say you had htaccess hijack & a malicious php file (in /chave/leyxus.php) and a whole heap of redirects redirecting to it.

If that’s all that’s in the file nuke the file and start a fresh by either taking a copy of a stock Wordpress file htaccess (if you’re using Wordpress) or generate a blank one.

Now that your files are restored however you really need to identify how that file got compromised (whether incorrect write permissions or compromised wp plug-in)

1 Spice up
3

Thanks. This is what I suspected. And the reason I found this was because I was looking at securing public_html for the exact reasons you mention. Thanks very much.