Theme files hacked – link added after body tag

Hello,

I wanted to share a problem I had recently. One of my clients, hosted on GoDaddy, had all of her themes hacked. Since the date and time stamps on the theme files had not changed, I can only assume the server got hacked.

The problem was a link to a payday loans site was being inserted underneath the body tag.

I found three extra things in functions.php named b_call, b_start, and b_end. I removed that whole extra section. The beginning and end are shown here (without the actual hack code inside):

if (!function_exists("b_call")) {
... (hack code removed)
add_action("wp_head", "b_start");
add_action("wp_footer", "b_end");
}

There was also a record in the wp_options table, with the option name _metaproperty. I deleted that record.

That seems to have fixed it. I changed all of the passwords and installed some security plugins so maybe we’ll get notified the next time GoDaddy and our account gets hacked.