Has my site been hacked? (5 posts)

  1. paulwallas
    Posted 5 years ago #


    I am in the middle of setting up my site and I have noticed that at the end of every page is 'Shell cr57 GIF89a;'

    I can't find it in any source code and I have removed all plugins. Is this a hack? what the hell is it?

    Can anyone please help?

  2. MickeyRoush
    Posted 5 years ago #

    Sounds like a shell uploader. Seeing shell and cr57 together is not a good thing. You may need to see generated source to view any hidden code.

    In Firefox:
    > Tools
    > Web Developer
    > View Source
    > View Generated Source

    But that may still not reveal anything. Once it's up in your install, removing plugins and themes may not remove it. Some cr57 shell uploaders are pretty nasty.

  3. paulwallas
    Posted 5 years ago #

    Thanks mickey

    I have checked generated sourece and it just displays the same as what is rendered in the live browser. I have no idea or heard of this, what should be I looking for and is there a way to fix it?

  4. paulwallas
    Posted 5 years ago #

    One other thing, if I change my theme the characters dissapear. The theme I am using is https://github.com/murtaugh/HTML5-Reset-Wordpress-Theme/issues/25

  5. MickeyRoush
    Posted 5 years ago #

    It may have been in your theme. I would definitely replace everything and make sure the theme is a fresh download. If it continues, you should let the theme developers aware of your issue, ooops it looks like you already did. (It could also be brought in via another site on your server. Those shell uploaders can be very nasty. I would replace everything first and see how it goes.)

Topic Closed

This topic has been closed to new replies.

About this Topic