Hack fix and and old topic comes back.

Resolved CosmaP
(@cosmap)

13 years, 2 months ago

A friends website was hacked over the weekend.

It was blocked by Google and the ISP and we were told to sort it. No problem there. I found the offending files and removed them.

Now the problems start.

The site started showing

Fatal error: Class ‘NOOP_Translations’ not found in /websites/123reg/LinuxPackage22/pr/ac/ti/practicalmiracles.com/public_html/wp-includes/l10n.php on line 503

I googled about and it transpires this was an issue in 2.xxx and the advice was to replace some of the files in the the wp_include folder. but this did not help. I ended up overwriting all the files with 3.5.1 files freshly downloaded from the WordPress site. Still no good.

Any idea’s?

Thanks

Viewing 7 replies - 1 through 7 (of 7 total)

esmi
(@esmi)

13 years, 2 months ago

You need to start working your way through these resources:
http://codex.wordpress.org/FAQ_My_site_was_hacked
http://wordpress.org/support/topic/268083#post-1065779
http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
http://ottopress.com/2009/hacked-wordpress-backdoors/

Additional Resources:
Hardening WordPress
http://sitecheck.sucuri.net/scanner/
http://www.unmaskparasites.com/
http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

Thread Starter CosmaP
(@cosmap)

13 years, 2 months ago

I have actually read most of those, (and found your name helping some others with this same issue) but just do not seem to be resolving the situation.

I will go through them all again.

Thanks

esmi
(@esmi)

13 years, 2 months ago

Try:
– switching to the default theme by renaming your current theme’s folder inside wp-content/themes and adding “-old” to the end of the folder name using FTP or whatever file management application your host provides.

– resetting the plugins folder by FTP or phpMyAdmin.

– re-uploading all files & folders – except the wp-content folder – from a fresh download of WordPress. Make sure that you delete the old copies of files & folder before uploading the new ones.

Thread Starter CosmaP
(@cosmap)

13 years, 2 months ago

I have done the second suggestion, but not the first.

I will try that now.

Thx

Thread Starter CosmaP
(@cosmap)

13 years, 2 months ago

Well Doh!

Looks like I had fixed it following the suggestions you made elsewhere, then I broke it in an over zealous attempt to clear out the hack.

The site is up, all be it intermittently. I have changed all the passwords, except the SQL one that will not change. The hosting company are looking in to that (their support is terrible).

Time for me to carefully read all that hardening info.

Thanks for the help

suebid
(@suebid)

13 years, 2 months ago

I hope it’s okay to ask a question here -I’ve been sorting through the forum for days and can’t find an answer – not sure if i’ve been hacked or not. When you log onto my blog, there is a sign in box from an unknown source, readplatform.com. This comes up on some web browsers like internet explorer and firefox but not on chrome. My website is http://greatbigyes.com/. Can you help me? I need to get rid of this. Thanks!

esmi
(@esmi)

13 years, 2 months ago

@suebid: It is considered impolite to interrupt another poster’s ongoing thread with a question of your own. It causes significant problems for the forum’s volunteers and prevents us from being able to track issues by topic. Please post your own topic.

Viewing 7 replies - 1 through 7 (of 7 total)

The topic ‘Hack fix and and old topic comes back.’ is closed to new replies.

Hack fix and and old topic comes back.

Tags

Topics

Topics with no replies

Non-support topics

Resolved topics

Unresolved topics

All topics