Single Quote changed into other char (used to be hacked) (4 posts)

  1. abangfadli
    Posted 2 years ago #

    Hi there,

    I have a site running with a newest wordpress in http://www.abangfadli.com

    Few days ago it is hacked by some hacker, and they say they only modified the index.php but I guess there's in the database also.

    Look at the picture here :


    The single quote are changed into some strange sequence of character.
    I tried to reinstall the WP but nothing happens.

    Do you know how to fix this?

  2. bcworkz
    Posted 2 years ago #

    Not the first time a hacker lied about what they "only" did!

    The mangled content in your image is essentially a newsfeed, so something is intercepting dataflow and altering it. It's possible to clean out hacks, but if you miss one thing, it could reappear and you have to start the process all over again.

    You're really better off doing a complete, clean reinstall. Delete everything from the server and database. Reinstall a clean wordpress and restore database and uploads etc. from a known clean backup.

    See FAQ My site was hacked.

  3. abangfadli
    Posted 2 years ago #

    Hey bcworkz,

    Thanks for the suggestion!
    Actually, I have been restoring the database far before it gets hacked and everything is looking perfect. But, I still have some doubt in my site.

    Do I really need to delete the wordpress also?

  4. bcworkz
    Posted 2 years ago #

    Well, perhaps not, but to be absolutely sure you've removed all traces of the hack, you should. Some hacks back themselves up in multiple locations. So unless you wipe everything at once and start over, the hack could save itself in another area while you clean one area. Then when you move on to the next area to clean, the hack restores itself to the area you just cleaned.

    So unless you wipe everything at once, you could end up running in circles trying to clean out the hack.

Topic Closed

This topic has been closed to new replies.

About this Topic