functions.php automatically deleted every day

Sparkling
1

Hi
I’m using sparkling-child theme which works fine.
Except every morning, my site is screwed up because the file functions.php does no longer exist. I restore it every morning and the site is fine then but it happens again the following night.

As you can see on the picture attached, the sparkling-child directory is updated every night at 2am (Aujourd’hui à 2.24) ! I noticed the functions.php file is no longer present in the sparkling-child directory. I promise, i am in bed at that time and i don’t do anything

Any idea who or what is doing that to me ?

Thanks for your answers

Francois

2

Hey there

For sure this is not something that theme or WordPress capable to do, first of all, I would recommend to use some malware scan plugins like Wordfence, other way is to contact hosting support
Thanks

3

OK. Thanks. I’ll do that

4

You are welcome

Have a great day :slight_smile:

5

I installed wordfence and contacted my hosting support : effectively, it was one of their security process which was deleting my file functions.php every day.
So the problem is now to concentrate on the file iself. wordfence detected a problem :

Filename: wp-content/themes/sparkling-child/functions.php
File Type: Not a core, theme, or plugin file from wordpress.org.
Details: This file appears to be installed or modified by a hacker to perform malicious activity. If you know about this file you can choose to ignore it to exclude it from future scans. The matched text in this file is: $div_code_name=“wp_vcd”;

The issue type is: Backdoor:PHP/WP-VCD.5473
Description: Backdoor used for backlink injection and other malicious activity.

Should i attach the functions.php file so you can anlyse it ?

Rgds
Francois

6

Hi Francois

Thank you for coming back, no need to attach a file, probably you can easily solve this problem, just reinstall theme and observe it again, most probably only funciton.php file is affected and if you change it with original it should fix your problem