DEV Community

MD Pabel
MD Pabel

Posted on • Originally published at mdpabel.com on

How to Fix the WordPress White Screen of Death Caused by “Zeura” Malware

#malwaretype #websitesecurity #wordpressmalware

Is your WordPress site suddenly showing a blank white page? This phenomenon, known as the WordPress White Screen of Death (WSOD), is terrifying for site owners. While plugins or themes are usually the culprits, a specific type of WordPress malware is increasingly responsible for this crash.

In this post, we analyze a specific malware sample (often tagged as “PHP Encode by zeura.com”), decode how it works, and provide a step-by-step guide on how to fix WordPress White Screen of Death malware and secure your site.

The Symptom: Why Malware Causes the White Screen of Death

The White Screen of Death usually indicates a PHP error that stops the script from executing, but “Display Errors” is turned off in your WordPress configuration.

Malware causes this for three primary reasons:

  • PHP Version Incompatibility: The malware is old and uses functions (like create_function) that have been removed in newer versions of PHP (8.0+). When the malware tries to run, it triggers a fatal error.
  • Syntax Errors: The hackers often copy-paste obfuscated code incorrectly. A single missing semicolon in the injected code crashes the entire site.
  • Resource Exhaustion: The malware may try to send thousands of spam emails or mine crypto, exhausting your server’s memory limit.

Anatomy of the “Zeura” Malware Sample

We recently analyzed a malware sample often found in the header.php or index.php of infected themes. Here is the raw code structure:

<?php / ***PHP Encode v1.0 by zeura.com*** / 
$XnNhAWEnhoiqwciqpoHH=file( __FILE__ );
eval(base64_decode("aWYoIWZ1bmN0aW9uX2V4..."));
eval(base64_decode(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH)));
eval(ZsldkfhGYU87iyihdfsow(YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,2),YiunIUY76bBhuhNYIO8($XnNhAWEnhoiqwciqpoHH,1)));
__halt_compiler();
// ... [Encrypted Binary Data follows here] ...
Enter fullscreen mode Exit fullscreen mode

Decoding the Malware: How It Works

This is a Self-Extracting Dropper. It doesn’t look like normal code because it hides its malicious logic inside the file itself, usually after the __halt_compiler(); command.

Here is the step-by-step technical breakdown of the obfuscation:

  1. File Read (file( __FILE__ )): The variable $XnNhAWEnhoiqwciqpoHH reads the content of the current file into an array. It effectively reads its own source code.
  2. The First Layer (YiunIUY76bBhuhNYIO8): The first eval decodes a Base64 string which creates a helper function. This function is a slicer. It looks at the file array and grabs specific lines of code defined by offsets (e.g., lines 655 to 800).
  3. The Second Layer (ZsldkfhGYU87iyihdfsow): The script runs a second eval to create another function. This function is the inflator. It usually performs gzinflate(base64_decode($data)).
  4. The Payload Execution: The final line executes the logic:
    • It grabs the gibberish data stored after __halt_compiler();.
    • It passes it through the inflator function.
    • It evals (executes) the result.

What is inside the payload?

Once decoded, this specific malware usually reveals a PHP Web Shell (Backdoor) or a Link Injector. It allows the attacker to modify files remotely, inject spam links (pharmaceuticals, casinos) into your footer, or redirect your visitors to scam sites.

Step-by-Step: WordPress Malware Removal Guide

If your site has the White Screen of Death, follow these steps to clean WordPress site infected with malware.

Step 1: Access Your Server via FTP

Since the dashboard is inaccessible (WSOD), you must use an FTP client (like FileZilla) or your hosting control panel’s File Manager.

Step 2: Check index.php and wp-config.php

This specific “zeura” malware often infects the root index.php or wp-config.php.

  1. Open index.php in the root folder.
  2. Look for the <?php / ***PHP Encode v1.0 by zeura.com*** / line at the very top.
  3. The Fix: Compare the file with a clean version from the official WordPress.org repository. Usually, the default index.php is very short. If you see a massive block of base64 text, replace the file entirely with the clean version.

Step 3: Check Your Theme’s functions.php

The malware often hides in your active theme.

  1. Navigate to /wp-content/themes/your-active-theme/.
  2. Open functions.php and header.php.
  3. Remove any code resembling the sample above. Note: Back up the file before editing!

Step 4: Reinstall WordPress Core

To ensure all core files are clean:

  1. Download the latest WordPress ZIP.
  2. Extract it on your computer.
  3. Upload the wp-admin and wp-includes folders to your server, overwriting the old ones.
  4. Do NOT overwrite wp-content or wp-config.php (clean those manually).

Prevention: Securing Your Site Against Future Attacks

Once you fix WSOD WordPress issues, you must lock the door.

  • Disable File Editing: Add this line to your wp-config.php to stop hackers from using the dashboard to edit files: define( 'DISALLOW_FILE_EDIT', true );
  • Install a Security Plugin: Use Wordfence or Sucuri for WordPress malware detection. They can scan for obfuscated code patterns like eval(base64_decode(.
  • Change All Passwords: Database, FTP, and WordPress Admin passwords must be changed immediately after cleanup.

FAQ: WordPress Malware & WSOD

Q: Can I use an automatic plugin to fix the White Screen of Death?

A: No. If you have the WSOD, you cannot access the plugin dashboard. You must perform a manual cleanup via FTP first to restore access, then run a scan.

Q: Why does the malware mention “zeura.com”?

A: Zeura was a legitimate PHP encoding tool years ago. Hackers use cracked or modified versions of this tool to obfuscate (hide) their virus code so that simple scanners cannot read it.

Q: Is “eval(base64_decode)” always malware?

A: In the context of WordPress core files or themes, yes, it is almost 99.9% malicious. Legitimate developers rarely use eval for encryption in this manner.

Top comments (0)