[resolved] Continuing to be hacked - At my wits end (5 posts)

  1. roseba
    Posted 5 years ago #

    I'm going crazy trying to figure out this hack. I have reinstalled clean installs of WP, and my theme (after making sure it was clean), and the plugins I was using.

    NOTHING seems to be working.

    Last week, I deactivated all of my plugins and found the problem to go away, so I thought it was one of the plugins.

    Today, I deactivated all my plugins and I am still experiencing the problem.

    It has something to do with a custom permanlink structure of /%category%/%postname%.

    When I remove the custom structure, the problem goes away.

    A friend of mine had noted that someone (something) had been shelling into my account until April 16 when it stopped. He saw that in my error logs. It primarily tried to run procedures in wp-admin/index.php but failed. We don't know what succeeded.

    I have installed and reinstalled clean installs, I don't know what to make of the whole thing.

    When I reactivated the permalinks, the problem appears again. (It is deactivated now.) But I have placed code here so it can be analyzed.

    When you clink on a permalink, it will take you off site to a page with an iframe:

    The iframe is filled with this code:

    [please use a Pastebin to post large chunks of code, following forum etiquette]

  2. esmi
    Forum Moderator
    Posted 5 years ago #

  3. roseba
    Posted 5 years ago #

    I have been to every single one of these links and executed almost all of them except for exporting the database and making a new one. (Because I don't have really old backups, before the site was infected.)

    And some of the htaccess rules didn't work for me, and instead made it impossible for me to get back into my own site.

  4. esmi
    Forum Moderator
    Posted 5 years ago #

    If you don’t fully clean up after a hack, then you stay hacked. It’s not a new hack, it’s the same one.

  5. roseba
    Posted 5 years ago #

    esmi... which is why one tries their best to figure out what went wrong. It's working again, for now. I still don't know what was wrong so troubleshooting makes it very hard.

Topic Closed

This topic has been closed to new replies.

About this Topic