Title: Hacked Yz_Byte
Last modified: August 20, 2016

---

# Hacked Yz_Byte

 *  [isnet](https://wordpress.org/support/users/isnet/)
 * (@isnet)
 * [13 years, 6 months ago](https://wordpress.org/support/topic/hacked-yz_byte/)
 * Hello,
    Our WP sites have all been hacked and destroyed by Hacked Yz_Byte. Years
   of work destroyed. We are rebuilding the site but one site in the German language
   remains to have problems showing the umlauts correctly (ä,ü, ö etc.) Does anyone
   know how to overcome this? And, what is the best protection, fire-wall, for WP
   to prevent being hacked again? Appreciate your comments.

Viewing 7 replies - 1 through 7 (of 7 total)

 *  [esmi](https://wordpress.org/support/users/esmi/)
 * (@esmi)
 * [13 years, 6 months ago](https://wordpress.org/support/topic/hacked-yz_byte/#post-3572247)
 * See [Hardening WordPress](http://codex.wordpress.org/Hardening_WordPress).
 *  [babyskill](https://wordpress.org/support/users/babyskill/)
 * (@babyskill)
 * [13 years, 6 months ago](https://wordpress.org/support/topic/hacked-yz_byte/#post-3572319)
 * You need update all WP and Plugins.
 * _[sig moderated as per the [Forum Rules](http://codex.wordpress.org/Forum_Welcome)]_
 *  [esmi](https://wordpress.org/support/users/esmi/)
 * (@esmi)
 * [13 years, 6 months ago](https://wordpress.org/support/topic/hacked-yz_byte/#post-3572322)
 * **[@babyskill](https://wordpress.org/support/users/babyskill/)**: Please stop
   posting links to your site. These are community support forums – not free advertising
   boards.
 *  [babyskill](https://wordpress.org/support/users/babyskill/)
 * (@babyskill)
 * [13 years, 6 months ago](https://wordpress.org/support/topic/hacked-yz_byte/#post-3572326)
 * [@esmi](https://wordpress.org/support/users/esmi/): Sorry!
 *  Thread Starter [isnet](https://wordpress.org/support/users/isnet/)
 * (@isnet)
 * [13 years, 6 months ago](https://wordpress.org/support/topic/hacked-yz_byte/#post-3572398)
 * Hello,
    We reinstalled the site on a new server including wordfence and a firewall.
   Had the below message this morning. How do I correct this? How can I make the
   site show correct umlauts again? Thank you “ An option was found in your site
   that indicates it may have been hacked.
 * Severity: Critical
    Status New
 * The ‘blog_charset’ option in your database is set to ‘UTF-7’ which indicates 
   your site may have been hacked. If hackers can gain access to your database via
   phpMyAdmin for example, they will change this value in order to inject malicious
   code into other parts of your site or allow XSS attacks. The ‘badi’ hack does
   this. ”
 *  Thread Starter [isnet](https://wordpress.org/support/users/isnet/)
 * (@isnet)
 * [13 years, 6 months ago](https://wordpress.org/support/topic/hacked-yz_byte/#post-3572403)
 * Hello,
    Found the problem: All our sites suddenly had the option under Settings
   >>> Reading to set the character. I think this option is normally not there. 
   This was set to UTF-7 but this must be UTF-8. Change it to UTF-8 and save. (you
   will see that after saving the option of changing the UTF character has disappeared)
   Go into your widgets area and you will see that your widgets have been removed
   from the side bar except for one text widget which is placed there by the hackers:
   <script>document.documentElement.innerHTML = unescape(‘%48%61%63%6b%65%64%20%
   62%79%20%59%7a%2d%62%79%74%65’);</script> Remove this widget, clean your PC, 
   and start setting up your site again. Install wordfence and wp firewall. We have
   to redo hundreds of pages with German language.
 *  [Vijfkant](https://wordpress.org/support/users/vijfkant/)
 * (@vijfkant)
 * [13 years, 5 months ago](https://wordpress.org/support/topic/hacked-yz_byte/#post-3572586)
 * Thanks Isnet!
 * I have been strugling with this problem for month!
    Now the site is working well
   again. Thanks!
 * Gerlof

Viewing 7 replies - 1 through 7 (of 7 total)

 The topic ‘Hacked Yz_Byte’ is closed to new replies.

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 7 replies
 * 4 participants
 * Last reply from: [Vijfkant](https://wordpress.org/support/users/vijfkant/)
 * Last activity: [13 years, 5 months ago](https://wordpress.org/support/topic/hacked-yz_byte/#post-3572586)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics