"You need to pay for this crypt" Infection Help

Resolved SoMVeritas
(@somveritas)

11 years, 10 months ago

Hey everyone,

I had an issue with malware a few weeks back and seemed to have fixed it and my site was un-blacklisted by google.

Unfortunately, I’m having another infection it seems regardless of my countless measures to prevent it. My site (http://www.stateofmindgaming.com) hasn’t been blacklisted yes, nor does it come up on any website as being infected. It does however have “You need to pay for this crypt” text on every page at the top of my website.

I’ve googled the issue and have tried checking the index.php files as well as for the Tools Pack Plugin that they recommend, but I’ve had no luck.

Please let me know if you all know another fix to this infection, or another place/file I may be able to check to remove this.

Thanks!

Viewing 6 replies - 1 through 6 (of 6 total)

esmi
(@esmi)

11 years, 10 months ago

You must have overlooked a back door that allowed hackers to walk back into your site. It now seems to have a lot of spam links.
Scan report

You need to start working your way through these resources:
http://codex.wordpress.org/FAQ_My_site_was_hacked
http://wordpress.org/support/topic/268083#post-1065779
http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
http://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
http://sitecheck.sucuri.net/scanner/
http://www.unmaskparasites.com/
http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html
downeasy
(@downeasy)

11 years, 10 months ago
It’s entered directly into the HTML of your site.
```
<BODY> ....tag header...

You need to pay for this crypt

...more stuff..
```
Are you using an unlicensed copy of the Blender Theme?
downeasy
(@downeasy)

11 years, 10 months ago

And yeah, you are uber-infected.

Thread Starter SoMVeritas
(@somveritas)

11 years, 10 months ago

@esmi The report is mostly spam from the forums. I’ve opted not to use the type of forum though and they aren’t displayed on the website so I’m just going to delete them.

@ downeasy No, I purchased the Blender Theme off of themeforest.net What would you recommend I do to remove my “uber”-infection?

downeasy
(@downeasy)

11 years, 10 months ago

I don’t know if it’s the best solution, but using Akismet along with Bulletproof Security plugin is working pretty well for my sites. BPS does a great job handling robots.txt limitations and .php exploits. Nothing is 100% perfect, but these two plugins don’t seem to conflict. BPS isn’t even that big of a resource hog.

I’m not associated with either, they are just what I have found to work for me and my sites.

As for cleaning up, remove all those spam comments and find a theme and database checker that will look for suspect code. I’d recommend one, but I haven’t used any at this point.

Thread Starter SoMVeritas
(@somveritas)

11 years, 10 months ago

I was able to find the code and remove it.

@downeasy Thanks for the recommendations of plugins. I have installed them and am trying them out. I hope to see improvements in security and not have to worry as much. Thanks again!

Viewing 6 replies - 1 through 6 (of 6 total)

The topic ‘"You need to pay for this crypt" Infection Help’ is closed to new replies.

"You need to pay for this crypt" Infection Help

Tags

Topics

Topics with no replies

Non-support topics

Resolved topics

Unresolved topics

All topics