Andrew Nevins
(@anevins)
WCLDN 2018 Contributor | Volunteer support
Which theme are you using?
I had it built several years ago it is a custom theme. i am not sure if he used a template or not.
Andrew Nevins
(@anevins)
WCLDN 2018 Contributor | Volunteer support
Can you try deactivating all plugins & see if the code is still there?
i have deactivated all of them it is still there . . .
This actually happened to one of my client’s sites. Thankfully it’s still in a staging environment. I’m thinking we got hacked tangerine3.
A malicious script is writing javascript to header.php. I’ve followed basic steps:
http://codex.wordpress.org/FAQ_My_site_was_hacked
I’ll watch this thread. For immediate, albeit temporary, fix, on a live site, delete those lines out of header.php.
Andrew Nevins
(@anevins)
WCLDN 2018 Contributor | Volunteer support
Then it is apparent that you need to contact your theme’s vendors/ developers.
ok i have also updated all my plug ins and updated to wordpress 3.6 and it is still there so i will try what you say above. my creator of my website does not respond to me anymore. . . .
why is deleting the text out of header.php only a temporary fix?
Andrew Nevins
(@anevins)
WCLDN 2018 Contributor | Volunteer support
It’s not a temporary fix, it’s just hiding the symptom.
here is my header.php file. If you look down in the middle I can see where this header code starts “try{if(window.document) . . . ” But I don’t know if everything below it is part of my header file or not. So don’t know what to delete.
Sorry, you can’t post hacked code here – you have to go through the resources listed above.
what is that script actually doing? what happens if I just leave it until I can either do all the steps above or find someone to do all this for me? I am not experienced enough to go through all that.
It’s not a temporary fix, it’s just hiding the symptom.
Correct, I’m sorry if my wording was misleading. @tangerine3: You’re not fixing anything by deleting those lines because they are being written by another script. It will guaranteed write those lines, or a variation thereof, again once you delete them.
Follow the steps that @esmi provided and you should be okay. I’ll update this thread as I work on the issue as well.
looked through all the resources and all this stuff is way over my head. ran the exploit scanner and a bunch of stuff came up that I have no idea what they are talking about.
I don’t have a blog just a informational website for our business. Seems like alot of the help was for blogs only? I removed the bad code out of the header.php, scanned my computer and removed threats and just see what happens in the next couple of days.
I’m still waiting for an answer to what the bad code does? Guess i’ll have to hire someone on craigslist to do check all this for me as my web guy is not responding to me and i have no idea what i’m doing or if i should be doing anything at all?
Seems like alot of the help was for blogs only?
No, a hacked site is a hacked site no matter whether you call it a blog or website. If you don’t fix the problem completely, it will keep happening and it can result in other sites on your hosts server being hacked or even causing the server go down. If you have a hacked site and don’t deal with it, your hosting company may take your site down.
If you want to hire someone, talk to Securi , or someone who really knows what they are doing.
