WordPress.org

Ready to get started?Download WordPress

Forums

Site has been hacked (12 posts)

  1. AmauryD
    Member
    Posted 11 months ago #

    Hello,

    My site has been hacked but with the help of some topics here I restored an old version of the site via ovh manager.
    So it's there again but I can't access as a user as my logins has been hacked and changed or removed. And when I asked to generate a new password it told me that none of my email addresses are known.
    What can I do ?

    Thanks

  2. esmi
    Forum Moderator
    Posted 11 months ago #

  3. AmauryD
    Member
    Posted 11 months ago #

    Humm

    None is working (some link are dead) and I'm not sure I kno how to use php admin.

    But I have access to the ftp of the site. Is there any file I can remove/edit ?
    Or is there any support here than can do this if I give my login ? I search everywhere but can't find any mail addresse or phone contact.

  4. esmi
    Forum Moderator
    Posted 11 months ago #

    WordPress is free software and this free, volunteer-staffed forum is the only support resource available via wordpress.org. If that does not suit your needs, you may want to consider hiring someone.

    In the meantime, you need to start working your way through these resources:
    http://codex.wordpress.org/FAQ_My_site_was_hacked
    http://wordpress.org/support/topic/268083#post-1065779
    http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
    http://ottopress.com/2009/hacked-wordpress-backdoors/

    Anything less will probably result in the hacker walking straight back into your site again.

    Additional Resources:
    Hardening WordPress
    http://sitecheck.sucuri.net/scanner/
    http://www.unmaskparasites.com/
    http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

  5. AmauryD
    Member
    Posted 11 months ago #

    I tried to donwload all the user*.php files from the wp-admin
    They all have a Redirector.E trojan. Is this the problem and how it can be fixed ?
    Seems it was there in the backup ?

  6. esmi
    Forum Moderator
    Posted 11 months ago #

    Please see the links I posted above.

  7. AmauryD
    Member
    Posted 11 months ago #

    Thanks esmi for the answer, I didn't know
    But I already saw all these links. It's for people who know what they are talking about not me. And the guy who did my website is somewhere in the world now and not available for the moment.
    But that's where I saw I can ask for a backup restore.
    And I'm aware I didn't fix the problem.

    Is there an easy way to do it ?
    removing the corrupted files but changing by ... ?

    Thanks

  8. esmi
    Forum Moderator
    Posted 11 months ago #

    Sorry but there is no easy way to clean up a site after a hack. The links I posted above outline the quickest & most effective way to de-louse a site after a hack. If you cannot manage this yourself, you may want to consider hiring someone.

  9. AmauryD
    Member
    Posted 11 months ago #

    Ok I can understand that and also about hiring. I think I should wait some days if the guy is still there.

    But I thought some admin there can restore a new password if I proove who I am.
    I found a backup from last year in the ftp. Maybe I can copy the user*.php files from there. Do you think it can work ?

  10. AmauryD
    Member
    Posted 11 months ago #

    Ok I found a way to connect to phpAdmin via ovh manager.
    But I'm a bit lost because It's not the same as in the page you linked.

    http://img22.imageshack.us/img22/1900/fw96.jpg

    Any help ?

  11. Maybe I can copy the user*.php files from there. Do you think it can work ?

    That won't really work for long if at all. By doing that you're not closing the door that the attacker used to compromise your site.

    Ok I found a way to connect to phpAdmin via ovh manager.
    But I'm a bit lost because It's not the same as in the page you linked.

    Carefully. The part in the instructions are over here.

    http://codex.wordpress.org/Resetting_Your_Password#Through_phpMyAdmin

  12. AmauryD
    Member
    Posted 11 months ago #

    Thanks Jan it's the link Esmi gave me.
    I just found a php recover from ovh manager (just one week old) but now the site said no connection to the base :(

Reply

You must log in to post.

About this Topic

Tags