Support » Fixing WordPress » Hacked Yz_Byte

  • Hello,
    Our WP sites have all been hacked and destroyed by Hacked Yz_Byte. Years of work destroyed. We are rebuilding the site but one site in the German language remains to have problems showing the umlauts correctly (ä,ü, ö etc.) Does anyone know how to overcome this? And, what is the best protection, fire-wall, for WP to prevent being hacked again?
    Appreciate your comments.

Viewing 7 replies - 1 through 7 (of 7 total)
  • You need update all WP and Plugins.

    [sig moderated as per the Forum Rules]

    @babyskill: Please stop posting links to your site. These are community support forums – not free advertising boards.

    @esmi: Sorry!

    We reinstalled the site on a new server including wordfence and a firewall. Had the below message this morning. How do I correct this? How can I make the site show correct umlauts again?
    Thank you

    An option was found in your site that indicates it may have been hacked.

    Severity: Critical
    Status New

    The ‘blog_charset’ option in your database is set to ‘UTF-7’ which indicates your site may have been hacked. If hackers can gain access to your database via phpMyAdmin for example, they will change this value in order to inject malicious code into other parts of your site or allow XSS attacks. The ‘badi’ hack does this. ”

    Found the problem:
    All our sites suddenly had the option under Settings >>> Reading to set the character. I think this option is normally not there. This was set to UTF-7 but this must be UTF-8. Change it to UTF-8 and save. (you will see that after saving the option of changing the UTF character has disappeared) Go into your widgets area and you will see that your widgets have been removed from the side bar except for one text widget which is placed there by the hackers:
    <script>document.documentElement.innerHTML = unescape(‘%48%61%63%6b%65%64%20%62%79%20%59%7a%2d%62%79%74%65’);</script>
    Remove this widget, clean your PC, and start setting up your site again. Install wordfence and wp firewall. We have to redo hundreds of pages with German language.

    Thanks Isnet!

    I have been strugling with this problem for month!
    Now the site is working well again.


Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘Hacked Yz_Byte’ is closed to new replies.