Trying to fix hacked site, bad code added to first line of each php

  • mixmethods

    (@mixmethods)


    9 years, 8 months ago

    Hi all, I’m helping a friend with his hacked WordPress site, and it appears that almost every .php file has a long string of random characters on line 1 after “<?php”.

    Oddly, certain php files have a line or two of added code at the very end, like an extra bracket or small snippet of several characters, but the main culprit seems to be that code on line 1.

    I have been manually going through some of the php files, and the site is now at least functional, but it has a lot of errors from the many php files that still have the bad code. Being as there are hundreds of php files, is there any easier way to automate this, rather than going through each php file manually? Or, maybe another way I should be going about this? Thanks for the help!

Viewing 7 replies - 1 through 7 (of 7 total)
  • Jeffrey van Rossum

    (@jeffreyvr)

    9 years, 8 months ago

    What you could do:
    – Upload a clean WordPress install (core files).
    – Go through your theme files, delete the bad code or just upload an backup (or just upload an backup of your core and theme altogether).
    – Check whether your file and folder permissions are set correctly (safely).
    – Make sure your plugins and installation is up-to-date.

    Also check out this FAQ:
    http://codex.wordpress.org/FAQ_My_site_was_hacked

    Thread Starter mixmethods

    (@mixmethods)

    9 years, 8 months ago

    Thank you! I have been reading through the docs on fixing hacked sites. Are all of the core WordPress php files left unchanged except for the wp-config file?

    One of my issues is that I currently cannot access the login page because of the hack. It simply shows a few text symbols at the moment.

    edit: I also remembered that the installed version of WP is not current. (I think it’s 3.3), will that also potentially cause issues when I replace with clean files?

    Jeffrey van Rossum

    (@jeffreyvr)

    9 years, 8 months ago

    No problem 😉

    Are all of the core WordPress php files left unchanged except for the wp-config file?

    Yes.

    One of my issues is that I currently cannot access the login page because of the hack. It simply shows a few text symbols at the moment.

    You can log in after you upload the “fresh”-core-files.

    …will that also potentially cause issues when I replace with clean files?

    I don’t think so. WordPress will notice the update and will make a change to your database (You’ll get a page for that on first visit). That’s all.

    Thread Starter mixmethods

    (@mixmethods)

    9 years, 8 months ago

    ok! I’ll make sure everything is completely backed up and then try replacing all of the core files. Thanks again!

    dstefani

    (@dstefani)

    9 years, 8 months ago

    Hello all,

    I’ve recently been called upon to fix a broken WP install for a client and I’ve found that many of the core WP files as well as plugin files have a huge string added to the first line, I won’t post all of the code, but the PHP variable looks like this:

    <?php $htmifqciwz = '... myMalCodeGoesHere...'

    I’ve never seen this before and this thread is the first one I fould that is spot on to the problem my client has.

    I’ll be looking at the support link above, but I thought it good to share and if anyone has more info.

    Thanks!

    – D

    Mark Ratledge

    (@songdogtech)

    9 years, 8 months ago

    @dstefani: You are responding to an old thread; post your own new topic.

    But basically, you got hacked. Work your way through these resources and follow all instructions to completely clean your site or you may be hacked again. See FAQ: My site was hacked « WordPress Codex and How to completely clean your hacked wordpress installation and How to find a backdoor in a hacked WordPress and Hardening WordPress « WordPress Codex.

    Change all passwords. Scan your own PC. Use http://sitecheck.sucuri.net/ before and after.

    Tell your web host you got hacked; and consider changing to a more secure host: Recommended WordPress Web Hosting

    If you can’t do the work yourself, consider looking for a reputable person to fix it correctly on freelancing sites such as Elance. (It’s not a good idea to respond to unsolicited emails from forum users offering to work for you.)

    dstefani

    (@dstefani)

    9 years, 8 months ago

    @songdogtech

    Seems that this is a “popular” problem, I found this post useful

    Thanks for the links.

    As far as a new post, I didn’t realize this was that old, for the sake of the community should I post a new thread with my findings?

    Thanks – Don

Viewing 7 replies - 1 through 7 (of 7 total)
  • The topic ‘Trying to fix hacked site, bad code added to first line of each php’ is closed to new replies.