Support » Fixing WordPress » Hacked by hmei7

  • website only up for a couple days and got this…

    can access the admin and cpanel…

    i’ve read some instructions on how to fix this, but i’m not sure if he’s modified his methods or not. when i try to create a new post, it’s creating fine, but when trying to go to the post on the site, it’s coming up as the same (hacked by hmei7)

    how can i fix this, and how can i prevent this in the future? my site’s only been up for a couple days and i used a very secure auto-generated password for the database…

Viewing 12 replies - 1 through 12 (of 12 total)
  • If it has only been up for a few days and their is little content, I would re-install to a new database on a good host.

    okay, thanks for that suggestion.

    any idea where the script code might be hiding? i’ve looked in wp_posts, but don’t see it

    It can be quite hard to find, Scan your site at Sucuri, and perhaps seek there expert assistance if you desire

    As the site is known now to have been hacked, you should protect your visitors now and upload a .maintenance file.

    i’ve downloaded the entire database and can’t find any instance of “hmei7″…

    are there any plugins i can use to keep this from happening again? i was using bulletproof / bps security…

    do you really think it’s a host issue? Asus, IBM, Siemens, Panasonic, Yamaha just to name a few have all been hacked by this joker…

    i’ve downloaded the entire database and can’t find any instance of “hmei7″…

    I am sure even a script kiddie would not include a direct reference to a later labeled piece of malware in your db.

    Asus, IBM, Siemens, Panasonic, Yamaha just to name a few have all been hacked by this joker…

    Can you provide a knowledgeable source link for this statement please?

    If it is well known also search for how it was fixed and manipulated?

    here’s just one link

    i’ve searched for how it was fixed, but the fix in my case didn’t work. supposedly people fixed it by finding the script in the wp_posts… but in my case i couldn’t find it.

    i really need to know if this is a server issue, a theme issue, or a wordpress issue.

    with huge famous sites getting hacked by this guy, i can’t imagine it’s a server issue…unless you think sites like Asus are using crap servers and webmasters… don’t get me wrong, i just need to know what the real problem is




    Go through this WordPress forum link that may help you.

    Also look for similar links in this forum. There are several threads that will answer your questions.

    You need to alert your web-host too.

    I had the same “hacked by hmei7” issue on one of my site earlier.

    Hacker managed to get in the srver and modified header.php and index.php.

    What you have to do is replace both of them if you have old back up, or delete the current one and replace with new files.

    I would also follow the instrcutions here to clean your site :

    How To Completely Clean Your Hacked WordPress Installation


    I had the exact same issue last night. I was also using BPS, yet I noticed that even though bps was uploaded, there were warnings on the UI about possible cracks.

    Were you by any chance using a landing page theme?


    I had custom WP theme, and it was upto date as well as the few plugins I used.

    I connect to server using FontPage, and when I looked at the server log, that frontpage file was the only other file that been modified with header.php and index.php.

    Not sure if conecting using FrontPage has got anythin gto do with this though.

    This hmei7 guys has been pretty much everywhere. Just Google the name and you’ll see he’s apparently Indonesian and recently it is claimed the he has hacked a large data centre resulting in the defacement of over 5000 sites.

    The Amateur Radio Club site I help maintain has been done over by this guy and upon deep investigation I found index.old files in pretty much every directory, I also found randomly named PHP files containing large strings and missing closing tags which I presume was some kind of injection / shell exploit attempts and also his calling card file x.txt.

    My friend who hosts the site for our club also had 3 other domains under his hosting which were also defaced / penetrated / violated.

    The first time it happened it “appeared” as if the club site had been attacked by a group called wild clique and we didn’t really understand the nature of the attack so we fixed it up as best we could but
    the site has since been attacked several times by various hacker groups and individuals.

    Today, I’ve been with my friend and we’ve completely ripped out the club’s site and upon going through the files we’ve found no end of files that shouldn’t be present as I described at the start of this reply.

    The site was so badly affected we couldn’t risk using any of it as such and so had to go through quite a complicated procedure of installing a clean but newer version of web software and slowly and systematically “merging” the content after sanitizing what we could.

    I’m actually about half way through restoring the old data on the newer platform and now the penny has begun to drop on what’s happened.

    My friend’s other sites under his hosting comprise of two joomla 2.5 sites, a custom HTML site and our club site formerly running Joomla 1.5.

    I think this guy initially penetrated the club site with a shell script or some other injection / RFI and then went on to take over the rest of the domains under my friends account from there. Or at least Mr hmei7 opened the door for others to do it. We certainly found the same files on the other domains too and the only thing they all share in common is they are all under the one user hosting account.

    Without waffling on needlessly, the point I am trying to make is, if this guy’s been at your site, I wouldn’t trust a SINGLE file or directory and I’d be looking at all my other sites closely too.

    Just because your sites aren’t defaced or whatever doesn’t mean there isn’t something nasty sitting and waiting!

    I suggest everyone wanting to secure their sites familiarise themselves with the following hacking techniques so as to understand how these attacks work and how to counter them in the future.

    RFI (Remote File Inclusion)
    LFI (Local File Inclusion)
    SQL Injection
    XSS (Cross Site Scripting)

    It is also important to keep every aspect of your site’s up to date; from core to plugins! You should also make sure you follow all steps listed by the creators of any scripts or software you are using to keep them secured.

    I’m only aware of this after the fact of course, but if this info can help others and prevent them from falling foul to this hmei7 and others then it was worth posting.

    I should add that since we have been attacked, I have spent countless hours researching, reading about and trying out the attacks listed above and more besides and I am now better prepared to protect my sites now I know how some of these attacks work and have seen them in action with my own eyes.

    I will admit that during my research I have actually been on Google and have dorked a few vulnerable sites and I’ve penetrated them using various freely available penetration techniques BUT I am not a malicious person and I have not and will not use any of the data I managed to exploit. I did it purely for educational purposes to see how it was done and if it could still be done on a live site and in most cases, there are PLENTY of sites vulnerable to these attacks still out there.

    In my case, I have of course notified the sites I have penetrated and hopefully they will act on my information.

    So take my advice folks – keep up to date with your software, keep up to date with your knowledge and if you suspect you’ve been hacked, don’t trust a single file – Check every file and folder under your account!

    Peace and stay safe!

Viewing 12 replies - 1 through 12 (of 12 total)
  • The topic ‘Hacked by hmei7’ is closed to new replies.