Site hacked by B0Y H4CK3R

Check the following files in your wp-content folder:

404.php
archive.php
index.php

Does anybody know what security hole this takes advantage of? e.g. how without wordpress or server or ftp username/pw do they

1. login as admin
2. Change admin email
3. Change admin password
4. Overwrite theme files

@ fog99uk

Are you sure WordPress is at fault here? It could be your server setup. For example, if a hacker can leverage symlink on your server it doesn’t matter what you’ve done to harden your site from the HTTP protocol. Locking down a symlink attack is the responsibility of your host or whoever manages your server.

Since there are hundreds if not thousands of ways a hacker could be accessing your site, I’m going to post quite a few links that may help you, some have already been mentioned, some have not. Also, the only thing YOU can do to prevent a symlink attack is set the wp-config.php file permission to 400, block access to it with .htaccess, and possibly utilize Options -FollowSymLinks +SymLinksIfOwnerMatch and maybe disable the functionality with php.ini (I’m not saying that’s how they’re attacking you, it’s just an example that someone else could possibly benefit from).

Check your site(s) here:
1. http://sitecheck.sucuri.net/scanner/
2. http://www.unmaskparasites.com/
3. http://www.virustotal.com/
4. http://www.phishtank.com/
5. http://www.browserdefender.com/
6. http://ismyblogworking.com/
7. Google Safe Browsing (to access a site’s google info, add their domain to the end of this):
http://www.google.com/safebrowsing/diagnostic?site=
example:
http://www.google.com/safebrowsing/diagnostic?site=example.com
8. Check your URL at scumware.org to see if your site has already been classified as malicious:
http://www.scumware.org/search.scumware

Backup everything and put that backup somewhere safe. This is in case you have problems later on. Even though you could be backing up infected files, it is more important to have a backup up of your work, for if you make a mistake cleaning your site, you will still have the backup(s).
1. http://codex.wordpress.org/WordPress_Backups
2. http://codex.wordpress.org/Backing_Up_Your_Database
3. http://codex.wordpress.org/Restoring_Your_Database_From_Backup

Then read these:
1. http://codex.wordpress.org/FAQ_My_site_was_hacked
2. http://wordpress.org/support/topic/268083#post-1065779
3. http://smackdown.blogsblogsblogs.com/2008/06/24/how-to-completely-clean-your-hacked-wordpress-installation/
4. http://ottopress.com/2009/hacked-wordpress-backdoors/
5. http://wpmu.org/why-you-should-never-search-for-free-wordpress-themes-in-google-or-anywhere-else/
6. http://blog.sucuri.net/2012/03/wordpress-understanding-its-true-vulnerability.html

If you have indications of possible timthumb hacking, please read these:
1. http://blog.sucuri.net/2011/08/timthumb-php-security-vulnerability-just-the-tip-of-the-iceberg.html
2. http://markmaunder.com/2011/08/02/technical-details-and-scripts-of-the-wordpress-timthumb-php-hack/
3. http://www.wpbeginner.com/wp-tutorials/how-to-fix-and-cleanup-the-timthumb-hack-in-wordpress/
4. http://wordpress.org/extend/plugins/timthumb-vulnerability-scanner/

Once your site is clean, then read these:
1. http://codex.wordpress.org/Hardening_WordPress
2. http://codex.wordpress.org/htaccess_for_subdirectories
3. http://www.studiopress.com/tips/wordpress-site-security.htm
4. http://stopbadware.org/home/security

Need more help?
1. https://badwarebusters.org/

If you believe your personal computer (not your host server) is infected please read these:
1. MajorGeeks.com malware removal:
http://forums.majorgeeks.com/showthread.php?t=35407
2. MajorGeeks.com how to protect yourself from malware:
http://forums.majorgeeks.com/showthread.php?t=44525

Hi fog99uk,

An easier solution would be to do the following:

1. Make a backup of your website
3. Re-install a new WordPress in a different location (test sub domain domain or so)
4. Restore the database
5. Change the passwords for the usernames
6. start installing all the plugins
7. Redownload a new version of the theme you are using and apply it
8. If all is fine, backup this website and restore it on the live website.

MangoMM wrote:

Woah Woah Woah…

Too much information for a noob – you are all scaring the guy with 1,000,000 links to resources which may or may not be useful.

Sorry it’s my normal response when someone says they’ve tried everything and only the people directly involved know everything that’s going on, ‘hence all the links. Maybe they’ll find something that helps them, maybe not. So no matter what anyone posts, there will always be some info/resources which may or may not be useful (as a third outside party, there is no way to be sure). I may be different, but I like to have has much knowledge as I can and in one place. And it’s nice when someone can organize it in an easy to follow structure as well.