• Resolved Rose

    (@eos-rose)


    I just went to work on a new theme and discovered that my site has been hacked. At the bottom of each page is a long list of garbage links. Here’s a little preview of what I’m looking at:

    <!-- google --><font id="bxhbe"  color="e419b0"  style="height: 0;overflow: hidden;width: 0; position: absolute; font-family:courier; font-size:19px" >
    xeex402109
    <a href=http://hiretheitpros.com/analysis//a/d/corrigan91021.php>corrigan insurance md</a>
    <a href=http://1times1.net/cursos/lrma/j/vanagon91021.php>rental vanagon oakland ca</a>

    This is tacked on after my closing html tag. I’ve installed a new theme and viewed the site to see if that would resolve the issue, but the problem is still there. I’ve deleted all the plugins that I no longer need. Now I’m at a loss as to where to look, because it’s obvious that the problem isn’t with the template files and I’m not all that familiar with the rest.

    So now I have some questions.
    (1) If the problem is with a plugin, will deactivating the plugin deal with the issue, or do I need to delete it completely? I was thinking of deactivating all plugins one-by-one to see if I could find the culprit.
    (2) Is there a way to re-install WordPress and still keep my database intact? I really don’t want to start from scratch. XD
    (3) Is there a way to search all files for the code listed above, so that I can find the source of the problem directly? I’ve used the Exploit Scanner plugin, but there were too many false-positives for me to make any good use of the results.

Viewing 2 replies - 1 through 2 (of 2 total)
  • Thread Starter Rose

    (@eos-rose)

    Update: I just went through and deactivated all my plugins. No change. I’m going to assume that something is up with my wordpress installation.

    Thread Starter Rose

    (@eos-rose)

    Wow, okay, I wasn’t really thinking. Rather than re-installing, I set about overwriting files–and wouldn’t you know it, I found the culprit? Someone had added that ugly mess to my index.php file in the main directory. I’m not sure why I never thought of that particular file; in retrospect it’s pretty obvious. 🙂

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Hacked’ is closed to new replies.