Support » How-To and Troubleshooting » Eval, base64, JAVA hacked, could not clean them at all!

Eval, base64, JAVA hacked, could not clean them at all!

  • Hi,
    base64, eval, java and mix of them all are attacking WordPress sites regardless of any defense you have! At least it is my case!

    I have already deleted the whole site and restored the backups from previous dates (lost some posts, but had to).
    I have already changed FTP, CP and Admin passwords
    I have clean PC, scanned every day
    I have updated all files including WordPress, plugins and themes
    I have used many defense system (plugins/online)
    I have deleted some suspicious files and code lines
    I have tried checking the log files, blocking some IP’s and etc
    I have asked the host to scan the server, result was “clean”

    I am tired now
    Codes keep appearing in my site, they are being added to header file of themes. Could not stop them.

    This is dangerous for me, and visitors of my site because the codes are installing really bad software. Also, Google marks my site as attack site!! It is very bad.

    Could some one write a code to prevent WordPress files being amended? Any kind of check sum protection? Any bug report or any fix?

    And, there are many people having same problem being directed to DIY sites and so on, none works and problem stays as it was. This is not good, safety of WordPress is in question here. I personally do not want to migrate to another platform, I enjoy using WordPress, I enjoyed it for many years.

    Any help?

Viewing 11 replies - 1 through 11 (of 11 total)
  • Moderator Jan Dembowski


    Brute Squad and Volunteer Moderator

    Codes keep appearing in my site, they are being added to header file of themes. Could not stop them.

    I’m sorry you’re having a rough time of it. You haven’t successfully deloused your site, until that happens this will keep happening to you.

    You need to start working your way through these resources:

    Additional Resources:

    Good luck.

    Dear Jan Dembowski,

    Thanks for the reply.

    As I have mentioned above, I have tried all of the suggestions and directions. None worked for me.

    The hack codes have changed from

    Waiting for a fresh cure/idea.

    WordPress on it’s own is quite secure. Hate to say this, but if you move your website to another web host, with a clean install, changing all of your passwords I would bet you $$$ you won’t continue to be hacked.

    Sadly, it sounds like it’s time to try a new host. Find a host with WordPress expertise, who will help you monitor your site for hacks as well.

    Hi The Hack Repair Guy,

    I use few hosts, it is not about the hosting. All my sites are infected regardless of hosting service. I was suspicious about my own PC being infected, but it really is clean. I did a complete check (deep scan) with 3 powerful antiviruses.

    But, I did CHOMD the header.php to 444, lets see what happens.

    By the way, I am a big fan of WordPress, although am not a developer.


    Does the host you use do daily malware scanning and are you able to call them on the phone and discuss how to better lock down your site?

    If not, then your host is not meeting your needs, and time to move on…

    Yes, they do and I could call them any time I need. They have been providing me with hosting for over 5 years, upgrading their equipments every so often. They use the latest (nearly) software and hardware.

    I did not post the issue here for an easy fix, I really did work hard to solve it myself. There are many people having same issue out there, many with no knowledge of codes and hacks. Russian hackers are the root for this attacks and their software is being installed in innocent visitors computers. I am considering to shot down my sites until the issue is solved. i can not risk or damage my reputation.


    Are you running a shared hosting account where many websites are sharing the same file space?

    If so that may be a symptom to a bigger issue.

    Likewise, if you feel your computer(s) may be compromised and access information is being pulled from your computer, then I strongly suggest you use one of the many password management programs, like 1Password. That way your passwords are maintained in an encrypted format and can be more easily randomized respectively.

    Yes for the first part! And that was why I asked the hosting guys to scan the server two times more than it was planned.

    My computers are clean. Passwords are also get changed every so often after any modification.

    Thanks for your interest in helping me out.

    Hi all,

    Finally the repeated appearance of injected codes have stopped. I did not do anything else (after days of cleaning but gaining no good!) but, changing the permission of header.php file (in main theme) to 444. That’s it I think.

    Attack was only targeting the main theme/s header in main domain (but not sub-domains). I employed antivirus, firewall and anti-spam plugins, they are good but are not able to clean the malware, or even finding it! It kept showing 2-3 times a day! Now, it seems to be stopped. Hope it does not grow to infect other files! Finger crossed.

    After getting into trouble of changing the passwords, searching inside database, looking for log files and cleaning the server, I think I can have a sweet sleep tonight!

    Hope this helps others who have the same problem. However, keeping your site clean is not only changing the header file’s permission to 444! Be careful and do not amend core files any further!

    Hope this incident gives idea for developers to lock important core folders and files of wordpress and set a system to check the files every so often to see if they have been changed (recording the info like source/IP of the changer would be really great).

    Take care

    Moderator Jan Dembowski


    Brute Squad and Volunteer Moderator

    Hope this incident gives idea for developers to lock important core folders

    I’m glad you’ve solved it and I hope that works for you, but it’s not for developers to lock down your server for you.

    That was one of the links I’ve provided for you and you really should take it to heart.


    Hi Jan,

    I know

    it’s not for developers to lock down your server for you.

    , and for that reason I am not asking any one to do anything with servers.
    I did mention the locking system above, it could be
    a check sum protection,
    alert system when a file or folder is compromised with script/non-users or
    making vulnerable files/folders read only.
    I see your point, but my idea of locking was not related to server side.


Viewing 11 replies - 1 through 11 (of 11 total)
  • The topic ‘Eval, base64, JAVA hacked, could not clean them at all!’ is closed to new replies.