Title: Compromised File Last modified: August 22, 2016 --- # Compromised File * [RedSharpEye](https://wordpress.org/support/users/redsharpeye/) * (@redsharpeye) * [12 years ago](https://wordpress.org/support/topic/compromised-file/) * This is a bit of a conundrum and I am afraid information is a little flakey but here goes…. * The website (www.tangtini.co.uk) was initially hosted by Amenworld and was moved by the powers that be to Namesco. The site consisted of “ordinary” html and a subdomain for the wordpress blog. However on moving the namesco system decided that the blog was compromised and packed it into a tgz compressed file – but didn’t tell me! After speaking with thenm they have told me it is down to me to clean the blog and put it back up. * Whilst I am downloading the tgz file (all 1.5 gig) I thought I would seek help from you guys. * I guess I need to: - decompress the tgz - find out which version of wordpress it was (how?) - install wordpress locally? - Run something to clean it (but what?) - upload back to the website - perhaps install wordpress on the website? * Any help or suggestions would be gratefully received as my client (The Missus) is pretty ticked off at the moment. * Thanks in advance * Colin Viewing 10 replies - 1 through 10 (of 10 total) * Moderator [James Huff](https://wordpress.org/support/users/macmanx/) * (@macmanx) * [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187701) * Remain calm and carefully follow [this guide](http://codex.wordpress.org/FAQ_My_site_was_hacked). When you’re done, you may want to implement some (if not all) of [the recommended security measures](http://codex.wordpress.org/Hardening_WordPress). * Thread Starter [RedSharpEye](https://wordpress.org/support/users/redsharpeye/) * (@redsharpeye) * [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187733) * Thanks for the pointer the guides MacManX. * It seems to read that the work is done whilst WordPress is still up and running on the web. Namesco had removed the blog and packed it into a tgz file. If I unpack the file again wouldn’t their automated system detect it, pack it back up and send me to the naughty step? * Once this has been sorted I will implement the security measure for sure. * I do have some backups of the blog which was done by a plugin and emailed to me, but no idea on how to tell if they are compromised or not. * Moderator [James Huff](https://wordpress.org/support/users/macmanx/) * (@macmanx) * [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187734) * I trust the guide at [http://codex.wordpress.org/FAQ_My_site_was_hacked](http://codex.wordpress.org/FAQ_My_site_was_hacked) so maybe try restoring the site and following through with the cleanup. * Before you do that though, replace all core files with fresh copies from [https://wordpress.org/download/](https://wordpress.org/download/) and all plugins with fresh copies from [https://wordpress.org/plugins/](https://wordpress.org/plugins/) and all themes with fresh copies from [https://wordpress.org/themes/](https://wordpress.org/themes/) * Thread Starter [RedSharpEye](https://wordpress.org/support/users/redsharpeye/) * (@redsharpeye) * [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187735) * Hmmm, fresh copies sound like a plan but I’m not sure which version of WP the blog was on. * I have extracted the files locally and used Norton Internet Security to scan the folders an it didn’t report any viruses. Which file would be best to look at to find out the WordPress version? * Thread Starter [RedSharpEye](https://wordpress.org/support/users/redsharpeye/) * (@redsharpeye) * [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187740) * Aha, located the readme.html file and it is version 3.5.1. * I shall download that. Which files are the core files or is it all core files? * The plugin in the \wp-content\plugins older are askimet, nextgen=gallery and wp-db-backup. * The wp-content\themes folder has classic, default, twentyeleven, twentyten and twentytwelve and an index.php file which says * ``` ``` * Does that seem suspicious to you? * Moderator [James Huff](https://wordpress.org/support/users/macmanx/) * (@macmanx) * [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187742) * > Aha, located the readme.html file and it is version 3.5.1. * That’s probably how this happened in the first place. WordPress 3.5.1 has plenty of publicly known security vulnerabilities. * Stay safe and take this opportunity to upgrade to 3.9.2 now by replacing all of the core files (that’s all of the WordPress files except wp-config.php and those in /wp-content/) with files from a fresh download at [https://wordpress.org/download/](https://wordpress.org/download/) * The index.php file you’re quoting is normal, it’s part of WordPress and keeps prying eyes from snooping around directory structures. 🙂 * Thread Starter [RedSharpEye](https://wordpress.org/support/users/redsharpeye/) * (@redsharpeye) * [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187764) * Thanks for all your help. * So far I put the new version core files back up and the old /wp-content/ files( but with the latest plugins and themes – but I couldn’t find a classic and default themes so I haven’t uploaded those two) * The old wp-config.php file does not relate to the new host’s database name, user name and password. In fact there wasn’t a database file present at all on the host so I have made up a new database. I have yet to create a wordpress user on the database though. * Just need to find the old database backup’s and see if I can import them into the new database. hmmm, the backups are on another machine somewhere – looks like I have some rummaging to do. * I will keep you posted of my progress. * Cheers * Moderator [James Huff](https://wordpress.org/support/users/macmanx/) * (@macmanx) * [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187774) * > I couldn’t find a classic and default themes so I haven’t uploaded those two * Those haven’t come with WordPress for a while, so if you don’t use them, it’s safe to leave them out. The current default theme is Twenty Fourteen. * > The old wp-config.php file does not relate to the new host’s database name, > user name and password. * Excellent, might as well create a new one then using wp-config-sample.php as a template. 🙂 * > Just need to find the old database backup’s and see if I can import them into > the new database. * These may (or may not) help: * [http://codex.wordpress.org/Backing_Up_Your_Database](http://codex.wordpress.org/Backing_Up_Your_Database) * [http://codex.wordpress.org/Restoring_Your_Database_From_Backup](http://codex.wordpress.org/Restoring_Your_Database_From_Backup) * Thread Starter [RedSharpEye](https://wordpress.org/support/users/redsharpeye/) * (@redsharpeye) * [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187852) * Well I have tried several ways of getting wordpress running but have failed miserably 🙁 * Created a database, imported the old database into it, edited WP-config.php to the new database settings but when I navigate to the site I get http 500 internal server error. * So thought that perhaps it might be an idea to use the 1 click install to install wordpress in a different directory. That went ok ( During the install I set the table prefix to WP2_ so that when I import to backup it doesn’t clash) and I was able to see the hello world page. Imported the backup database and edited wp-config.php to use WP_ tables. I just get a white page and nothing more. Edit the wp-config.php back to WP2_ table prefix and I get the hello world back again. My guess is that perhaps the imported database is either a different MySQL version to the new install or the table format is different between the old and new versions of wordpress? * Any suggestions would be welcome. * Moderator [James Huff](https://wordpress.org/support/users/macmanx/) * (@macmanx) * [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187853) * > when I navigate to the site I get http 500 internal server error. * Internal server errors (error 500) are often caused by plugin or theme function conflicts, so if you have access to your admin panel, try deactivating all plugins. If you don’t have access to your admin panel, try [manually resetting your plugins](http://codex.wordpress.org/FAQ_Troubleshooting#How_to_deactivate_all_plugins_when_not_able_to_access_the_administrative_menus.3F). If that resolves the issue, reactivate each one individually until you find the cause. * If that does not resolve the issue, try switching to the Twenty Fourteen theme to rule-out a theme-specific issue. If you don’t have access to your admin panel, access your server via [FTP or SFTP](http://codex.wordpress.org/FTP_Clients), navigate to `/wp-content/themes/` and rename the directory of your currently active theme. This will force the default theme to activate and hopefully rule- out a theme-specific issue. * If that does not resolve the issue, it’s possible that a `.htaccess` rule could be the source of the problem. To check for this, access your server via FTP or SFTP and rename the `.htaccess` file. If you can’t find a `.htaccess` file, make sure that you have set your FTP or SFTP client to view invisible files. * If you weren’t able to resolve the issue by either resetting your plugins and theme or renaming your .htaccess file, we may be able to help, but we’ll need a more detailed error message. Internal server errors are usually described in more detail in the server error log. If you have access to your server error log, generate the error again, note the date and time, then immediately check your server error log for any errors that occurred during that time period. If you don’t have access to your server error log, ask your hosting provider to look for you. Viewing 10 replies - 1 through 10 (of 10 total) The topic ‘Compromised File’ is closed to new replies. * In: [Installing WordPress](https://wordpress.org/support/forum/installation/) * 10 replies * 2 participants * Last reply from: [James Huff](https://wordpress.org/support/users/macmanx/) * Last activity: [12 years ago](https://wordpress.org/support/topic/compromised-file/#post-5187853) * Status: not resolved ## Topics ### Topics with no replies ### Non-support topics ### Resolved topics ### Unresolved topics ### All topics